topic Re: Adding switchports to an Ether Channel on FTD in Network Security

Adding switchports to an Ether Channel on FTD

Chess Norris — Wed, 31 Aug 2022 15:03:40 GMT

Hi,

I have a FTD 1010 that I manage through FMC and I want to create an Ether Channel interface, but I am struggling to add Switchports to the Ether Channel.

The only Interfaces available when I create an Ether Channel, is routed interfaces. Is it only routed interfaces that I can use for this?

I have the following configuration on my Catalyst 3560 switch that I want to re-create on my FTD 1010. Is it possible?

!
interface Port-channel1
switchport trunk allowed vlan 2,10,13
switchport mode trunk
!

interface GigabitEthernet0/7
switchport trunk allowed vlan 2,10,13
switchport mode trunk
channel-protocol lacp
channel-group 1 mode active
!
interface GigabitEthernet0/8
switchport trunk allowed vlan 2,10,13
switchport mode trunk
channel-protocol lacp
channel-group 1 mode active
!

Thanks

/Chess

Re: Adding switchports to an Ether Channel on FTD

balaji.bandi — Wed, 31 Aug 2022 16:11:52 GMT

The only Interfaces available when I create an Ether Channel, is routed interfaces. Is it only routed interfaces that I can use for this?

is this on Switch side or FTD side ?

Catalyst 3560 switch that I want to re-create on my FTD 1010. Is it possible?

,yes this is possible, if this in production you will downtime, also any associated config will be changed accordingly.

Re: Adding switchports to an Ether Channel on FTD

Chess Norris — Wed, 31 Aug 2022 16:26:33 GMT

My goal is to only use the FTD device and not the switch at all. The problem is that I cannot select switchports when creating a portchannel interface on the FTD, which I can on the switch. Do I need to use subinterfaces instead?

Re: Adding switchports to an Ether Channel on FTD

balaji.bandi — Wed, 31 Aug 2022 16:49:37 GMT

My goal is to only use the FTD device

you mean FTD act as switch and Firewall ?

Re: Adding switchports to an Ether Channel on FTD

Chess Norris — Wed, 31 Aug 2022 17:19:36 GMT

Yes, that's correct. I'm trying to streamline my lab setup at home and only use the FTD and an access point. Everything else is working now on the FTD with switchports and VLAN and I use PoE+ on port 8 on the FTD for the AP. It's only the EtherChannel part that's left and if I can get that to work, I can skip the switch.

/Chess

Re: Adding switchports to an Ether Channel on FTD

Chess Norris — Thu, 01 Sep 2022 06:26:48 GMT

I found the answer here - https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/regular_firewall_interfaces_for_firepower_threat_defense.html#id_106621

I guess the switchports is a bit limited on the FTD 1010 comparing to a regular switch, but maybe they will add more switch features in an upcoming release.

/Chess

Re: Adding switchports to an Ether Channel on FTD

balaji.bandi — Thu, 01 Sep 2022 16:53:29 GMT

Thats right unlike old ASA 5505 can use ports as switch.