topic Firepower between ASA and Juniper. in Network Security

Firepower between ASA and Juniper.

guna.neo — Mon, 19 Sep 2022 12:52:13 GMT

Firepower is setup with ASA behind it. Need to setup IPSec between ASA and Outside/internet JuniperFW. I can see IKE and ISAKMP packets, but no ESP. Is this even possible:-

Use FMC to traverse IPSEC for an internal ASA

Any inherent policy in FMC that blocks ESP

Re: Firepower between ASA and Juniper.

Marvin Rhoads — Mon, 19 Sep 2022 17:02:31 GMT

If your default action in the Firepower Access Control Policy is to Block then the ESP (protocol 50) will be blocked.

The typical recommendation for such a use case is to put the source and destination of the IPsec tunnel in a prefilter policy rule with action of Fastpath. That way you skip all other ACP rules and Snort altogether.

Re: Firepower between ASA and Juniper.

Mark Elsen — Mon, 19 Sep 2022 17:05:16 GMT

- FYI : https://supportportal.juniper.net/s/article/Example-Configuring-site-to-site-VPN-between-SRX-and-Cisco-ASA-Route-based-VPN?language=en_US

https://tungdt.net/configure-site2site-vpn-between-juniper-srx-and-cisco-asa-firewalls/