topic Re: Using Interface groups in an access policy? in Network Security

Using Interface groups in an access policy?

Chess Norris — Thu, 10 Mar 2022 12:34:54 GMT

Hello,

I am doing a migration from a multi context ASA to a single context FTD. Both contexts in the ASA had a lot of sub interfaces and I want to make sure we don’t leak any traffic between the interfaces previously belonging to the two context.
Instead of manually add all interface zones in block rules, I wonder if I could use two interface groups and add the interfaces to those groups and then just do a block rule for traffic between those two interface groups?
I tried to add an interface group as an interface group, but when searching for that object in the ACP, I cannot find it either under Zones or Networks.

Thanks

/Chess

Re: Using Interface groups in an access policy?

balaji.bandi — Thu, 10 Mar 2022 12:42:16 GMT

how are you doing using FDM or FMC ?

Re: Using Interface groups in an access policy?

Chess Norris — Thu, 10 Mar 2022 12:43:27 GMT

I am using FMC and FTD 2130.

Thanks

/Chess

Re: Using Interface groups in an access policy?

Rob Ingram — Thu, 10 Mar 2022 12:45:01 GMT

@Chess Norris sounds like you need to use "Security Zones" - add the interfaces to the required zones and create the required ACP rules.

Re: Using Interface groups in an access policy?

Chess Norris — Thu, 10 Mar 2022 12:55:58 GMT

The problem is that all interfaces allready belong to invidual zones (one zone per interface), so I can not create a new zone because an interface can only belong to one security zone. Thats why I thought I could use interface groups instead, but it seams like I cannot use interface groups in an access policy

Thanks

/Chess

Re: Using Interface groups in an access policy?

balaji.bandi — Thu, 10 Mar 2022 12:58:45 GMT

Thanks for the information, then you need to do some ground work and change the design, most of the FTD are zone based.

You need to choose which path to go :

1. we did some migration with multi-instance with FTD 4K (FTD 21XX not support here i guess)

https://community.cisco.com/t5/security-blogs/migrating-asa-multi-context-to-ftd-multi-instance/ba-p/3893465

2. if you looking to zone with single instance then you need make design accordingly, this required some testing.

Re: Using Interface groups in an access policy?

Marvin Rhoads — Thu, 10 Mar 2022 13:06:31 GMT

Correct - ACP is zone-based and cannot use Interface Groups. NAT rules can use IGs.

Re: Using Interface groups in an access policy?

Chess Norris — Thu, 10 Mar 2022 13:50:36 GMT

Thanks everyone. I got all the information I need.

/Chess