topic Re: flexconfig in Cisco FTD in Network Security

flexconfig in Cisco FTD

shaikh.zaid22 — Wed, 29 Jun 2022 07:10:23 GMT

We have a cisco ftd configure via fmc.

We have a guest ADSL connection configured via Flexconfig PBR to route the guest subnet 10.10.251.0/24 to ADSL GW.

Now i have a requirement to exclude 2 ip addresses from the 251 range from the flexconfig PBR.

Need assistance how i can achieve it.

Re: flexconfig in Cisco FTD

balaji.bandi — Wed, 29 Jun 2022 08:14:06 GMT

check this guide : ( remove related config related to IP subnet you looking to remove) so it used default route

https://integratingit.wordpress.com/2021/04/18/ftd-policy-based-routing/

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/217588-configure-pbr-with-ip-slas-for-dual-isp.html

Re: flexconfig in Cisco FTD

Marius Gunnerud — Wed, 29 Jun 2022 09:57:52 GMT

I am assuming you have an ACL that is matching on the traffic that is to be sent to the guest subnet? If so, then it is just a matter of adding deny statement at the top of that ACL for the two IPs you want to exclude and then deploy.

Re: flexconfig in Cisco FTD

shaikh.zaid22 — Wed, 29 Jun 2022 10:59:44 GMT

Hi Marius,

You are correct, i have one subnet in one ACL that is called-in to the Flexconfig.

From this same subnet i want to remove/axe two ip addresses to not get forwarded towards the ADSL GW.

So shall just add the two ip's in the same ACL with Actions as Block ?

Re: flexconfig in Cisco FTD

Marius Gunnerud — Wed, 29 Jun 2022 11:10:00 GMT

Correct, just add the two IP in the same ACL with block action, above the permit rule (this is important), and you should be good.

Re: flexconfig in Cisco FTD

shaikh.zaid22 — Wed, 29 Jun 2022 11:25:16 GMT

Thanks Marius. I will do as directed.

However, do i not have to touch anything in the flexconfig part ?

Only ACL changes will suffice right ?

Thanks once again

Re: flexconfig in Cisco FTD

Marius Gunnerud — Wed, 29 Jun 2022 11:33:30 GMT

Just the ACL configuration.

Re: flexconfig in Cisco FTD

Marvin Rhoads — Wed, 29 Jun 2022 16:07:15 GMT

For PBR, the Flexconfig policy references the ACL. so changing the ACL suffices to change the net behavior of the Flexconfig policy

Re: flexconfig in Cisco FTD

shaikh.zaid22 — Sat, 02 Jul 2022 08:37:17 GMT

Thank Marius.

It worked.