Dstribuited SOHO firewall System

l.buschi — Fri, 15 Jul 2022 14:51:04 GMT

Hi all,

actually I have a system of 10 ASA5506x with firepower distribuited in 10 different locations.

The NGS are managed by FMC and I only have a unique access-control policy that can manage all of them.

Their configuration is very simple, they only have an inside interface, outside interface and guest interface. They only have a single source PAT using their public outside interface address. No Static NAT and no service aree reachable from outside.

Now I have to migrate these ASAs to FTD 1010, my question is:

in your opinion,

Is it better to create 10 different specific pre-filter rules, 10 specific nat rules and 10 specific access-control rules, or creating a uinque generic nat rule, 1 pre-filter rule and 1 access-control rule would be better?

Or a mix

Tks

Johnny

Re: Dstribuited SOHO firewall System

Rob Ingram — Fri, 15 Jul 2022 15:01:25 GMT

@l.buschi I would personally prefer to keep the deployment as simple as possible and use a single shared ACP where possible. You do have the ability to use object overrides

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/710/management-center-device-config-71/objects-object-mgmt.html#concept_8BFE8B9A83D742D9B647A74F7AD50053

"You can create an object whose definition works for most devices, and then use overrides to specify modifications to the object for the few devices that need different definitions. You can also create an object that needs to be overridden for all devices, but its use allows you to create a single policy for all devices. Object overrides allow you to create a smaller set of shared policies for use across devices without giving up the ability to alter policies when needed for individual devices."

topic Re: Dstribuited SOHO firewall System in Network Security

Dstribuited SOHO firewall System

Re: Dstribuited SOHO firewall System