topic Re: FPR-2110 HA configuration for Interface monitoring and Software in Network Security

FPR-2110 HA configuration for Interface monitoring and Software

Mit_har — Mon, 24 Apr 2023 03:22:52 GMT

Hi, Do we need to have the same type of interface for FPR-2110 HA Active/Standby configuration to core switches? For example, From FW 1, we have fibre connection to core switch A and from FW 2, we have copper connection to core switch B. will HA work on this design?

I wanted to use FPR-2110 for Internal routing or as a router on stick option. Please suggest which Firewall software I should purchase to full fill this requirement to work with C9300x switches? Firepower threat defense software or ASA software?

Re: FPR-2110 HA configuration for Interface monitoring and Software

Rob Ingram — Mon, 24 Apr 2023 08:43:31 GMT

@Mit_har the cisco documentation states you must have the same number and type of interfaces in an HA. On your diagram you've got different interfaces for the inside interfaces (port 3 an 4), that would not work.

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/720/management-center-device-config-72/high-availability.html

Ideally you'll have the FMC management software then deploy the FTD software image on the Firewalls, managing the FTD locally using FDM is not very good.

Re: FPR-2110 HA configuration for Interface monitoring and Software

Mit_har — Mon, 24 Apr 2023 08:51:00 GMT

Thanks.

Ok. we will use the same port on the inside network that is port 3. IF we use fibre interface on port 3 at FW 1 and Copper SFP on port 3 at FW 2, will it be ok for HA or we should have fibre interfaces on port 3 at FW 1 and FW 2 to achieve the HA.

Re: FPR-2110 HA configuration for Interface monitoring and Software

Rob Ingram — Mon, 24 Apr 2023 08:56:47 GMT

@Mit_har dcoumentation states it should have the same interface type. I would use fibre for both interfaces when building the failover pair.

Re: FPR-2110 HA configuration for Interface monitoring and Software

Mit_har — Mon, 24 Apr 2023 09:02:30 GMT

Thanks. can we use FPR-1120 in place of FPR-2110? what will be the limitation on the network if we go for FPR-1120. We wanted to use firewall as router (via trunk or sub-interfaces on the firewall side) for the inside network on the same link it is connect to core switch. Means, Firewall will be a gateway for Inside network via core switch.

Re: FPR-2110 HA configuration for Interface monitoring and Software

MHM Cisco World — Mon, 24 Apr 2023 09:09:01 GMT

NO you can not must same interface Number
if you use SFP in FW1 then you must use SFP in FW2
and ALSO same INTERFACE NUMBER

Re: FPR-2110 HA configuration for Interface monitoring and Software

Rob Ingram — Mon, 24 Apr 2023 09:07:31 GMT

@Mit_har possibly, looking at the datasheets the 2100 has better performance.

How many users and how much Firewall throughput are you expecting?

https://www.cisco.com/c/en/us/products/collateral/security/firepower-1000-series/datasheet-c78-742469.html

https://www.cisco.com/c/en/us/products/collateral/security/firepower-2100-series/datasheet-c78-742473.html

Re: FPR-2110 HA configuration for Interface monitoring and Software

Mit_har — Mon, 24 Apr 2023 09:11:00 GMT

We are looking for 1GBPS throughput with 150 users.

Re: FPR-2110 HA configuration for Interface monitoring and Software

Rob Ingram — Mon, 24 Apr 2023 09:15:44 GMT

@Mit_har the FPR1120 supports up to 4.5Gbps stateful inspection, so may suffice. What other features will be used on the Firewall?

Re: FPR-2110 HA configuration for Interface monitoring and Software

MHM Cisco World — Mon, 24 Apr 2023 09:20:43 GMT

https://community.cisco.com/kxiwq67737/attachments/kxiwq67737/discussions-network-security/1011038/1/Cisco%20Firepower%20Next-Generation%20Firewall%20(NGFW).pdf

Re: FPR-2110 HA configuration for Interface monitoring and Software

Mit_har — Mon, 24 Apr 2023 09:26:54 GMT

We are looking for IPS throughput.

Stateful inspection is indicated with ASA features. I think we can deploy either FTD or ASA on the firewall. Which Software version I should purchase to have IPS and routing function on the firewall. Is firewall comes with default routing option or do we need to ask our supplier to include in software version.

Re: FPR-2110 HA configuration for Interface monitoring and Software

Rob Ingram — Mon, 24 Apr 2023 09:30:24 GMT

@Mit_har if you wish to use IPS then you will need the FTD image, you should also purchase the FMC to manage the FTD HA pair.

Routing comes with the Base license, you will need to purchase the Threat IPS license.

Re: FPR-2110 HA configuration for Interface monitoring and Software

Mit_har — Mon, 24 Apr 2023 09:36:01 GMT

Ok. So we can go for FPR-1120 in place of FPR 2120. We shall achieve the same functionality with FPR-1120 with less throughout or users.

Re: FPR-2110 HA configuration for Interface monitoring and Software

Rob Ingram — Mon, 24 Apr 2023 09:39:07 GMT

@Mit_har yes you have the same functionality, just less performance on the FPR1120 compared to the FPR2110.

Re: FPR-2110 HA configuration for Interface monitoring and Software

Mit_har — Mon, 24 Apr 2023 09:42:14 GMT

Last question, In place of using firewall as router on stick option or via sub-interfaces to use firewall as router for the inside network, what are the other possible option for routing in firewall?

Re: FPR-2110 HA configuration for Interface monitoring and Software

Rob Ingram — Mon, 24 Apr 2023 09:47:32 GMT

@Mit_har sub-interfaces and routing between VLANs via the firewall seems to be the most straight forward option.

Re: FPR-2110 HA configuration for Interface monitoring and Software

Mit_har — Mon, 24 Apr 2023 09:48:42 GMT

What you mean by Users here? VPN user or something else?

Re: FPR-2110 HA configuration for Interface monitoring and Software

MHM Cisco World — Mon, 24 Apr 2023 09:50:21 GMT

FW as Router in stick and subinterface in FW is same freind.

I think you meaning using subinterface or vlan SVI in FW.

Re: FPR-2110 HA configuration for Interface monitoring and Software

Rob Ingram — Mon, 24 Apr 2023 09:52:00 GMT

@Mit_har not VPN users, number of users behind the firewall would provide an indication on the number of connections and scale.

Re: FPR-2110 HA configuration for Interface monitoring and Software

Mit_har — Mon, 24 Apr 2023 09:55:15 GMT

User means Number of IP behind the firewall or can u give more hints to me?