topic Re: How to configure firepower 1120 redundant interfaces in Network Security

How to configure firepower 1120 redundant interfaces

jhudspeth — Wed, 24 Aug 2022 15:23:00 GMT

Good Morning all,

I am working on a new network deployment and at the top is a Cisco Firepower 1120. I am going down to two datacore switches from the firepower and would like each datacore switch to have it's own uplink from the Firepower. Each inside interface will also have a number of sub-interfaces attached to it due to the need for additional subnets/vlans.

I am not seeing an option that will allow this to happen such as a vlan tagging per port or anything like that and could use some help!

For context, I am managing this 1120 through FMC.

Any help would be awesome!

Re: How to configure firepower 1120 redundant interfaces

balaji.bandi — Wed, 24 Aug 2022 15:49:36 GMT

Can you please draw a diagram how these are connected understand.

Re: How to configure firepower 1120 redundant interfaces

Rob Ingram — Wed, 24 Aug 2022 15:52:38 GMT

@jhudspeth here is the guide to create sub-interfaces using FMC

https://www.cisco.com/c/en/us/td/docs/security/firepower/670/configuration/guide/fpmc-config-guide-v67/regular_firewall_interfaces_for_firepower_threat_defense.html#id_86348

Re: How to configure firepower 1120 redundant interfaces

jhudspeth — Wed, 24 Aug 2022 16:00:27 GMT

@Rob Ingram Hey Rob,

Thanks for the response, I have created the sub interfaces, that isn't a problem, its creating a second "inside" link to my second datacore switch that I'm having trouble with.

@balaji.bandi Please see the crude drawing below:

Re: How to configure firepower 1120 redundant interfaces

Rob Ingram — Wed, 24 Aug 2022 16:15:18 GMT

@jhudspeth do these connections to the DC switches need to be a port-channel? If so create the Port Channel, then create sub-interfaces on the port-channel and add to the required zones.

Re: How to configure firepower 1120 redundant interfaces

balaji.bandi — Wed, 24 Aug 2022 16:21:30 GMT

Cheers for the diagram, are these 2 DC connected and Layer 2 extended ?

hope you are looking HA ? do you have another FP1120 ?

Re: How to configure firepower 1120 redundant interfaces

jhudspeth — Wed, 24 Aug 2022 18:28:08 GMT

@Rob Ingram Not necessarily no they do not need to be a port channel.

@balaji.bandi Currently it is just the single firepower no HA pair here.

Re: How to configure firepower 1120 redundant interfaces

balaji.bandi — Wed, 24 Aug 2022 18:45:36 GMT

ok you can do the subinterface on Firepower as rob suggested, on the switch side you can make as Trunk to allow that VLAN.

or am I missing something here ?

Re: How to configure firepower 1120 redundant interfaces

jhudspeth — Wed, 24 Aug 2022 18:54:56 GMT

@balaji.bandi The issue is, getting an individual uplink from the firewall to BOTH datacore switches, while keeping them on the same subnet, i don't see like a redundant interface option in FMC.

Re: How to configure firepower 1120 redundant interfaces

jwornstaff — Thu, 02 Nov 2023 12:19:41 GMT

Did you ever figure out a design for the redundant connections? I'm also struggle with a single 1020 and configuring redundant connections.