topic Re: FTD Interfaces in Network Security

FTD Interfaces

benolyndav — Sat, 22 May 2021 07:23:43 GMT

We ahve FTD2100 and have different security zones what is the purpose of interface groups and are they needed, i just created x2 new sub-interfaces and security zones but havent created interface groups there are other interfaces with groups, is this ok can it cause an issue down the line not having interface groups for these new interfaces/security zones ?

Thanks

Re: FTD Interfaces

Sheraz.Salim — Sat, 22 May 2021 08:45:15 GMT

There are two types of interface objects: security zones and interface groups. The key difference is that interface groups can overlap. Only security zones can be used in access control policy rules.

Re: FTD Interfaces

Carlos T — Wed, 12 Jul 2023 11:52:02 GMT

So it still works, even if you dont have interface group attached to the new interfaces.

My setup is similar to your scenario. I have a production firewall with many interfaces and security groups (one for each interface/subinterface).

I am creating a new subinterface, and also a new security group for that new subinterface, but I see on the interface output (devices / interfaces) that the new created subinterface has NO interface group attached.

The attachment of interface group to a interface I done on "objects / Object Management / Interfaces", then "Add Interface Group"

I put a Name, Select interface type as "routed" (as the other interfaces already configured), then on the list of available interfaces, I select the new interface created.

Then save and deploy.

But even following that procedure, I still dont see the Interface group attached to the Interface on the "Devices / Interfaces" output.

Any reason why?

Thanks,

Re: FTD Interfaces

benolyndav — Wed, 12 Jul 2023 13:30:50 GMT

Have you got the Interfaces selested in the selected interfaces tab in interface group and Interface in objects, also have you got all your firewalls selected.??

Re: FTD Interfaces

Carlos T — Wed, 12 Jul 2023 13:37:14 GMT

Thanks for the reply.

I just went to lunch, and when I come back, I see now the interface with the interface group attached to it on thje "Devices / Device Management / Interfaces" output.

Looks like it took a while to show it, as 45 mins ago (of course after deployed) this output was not showing the interface group attached.

Thanks for your reply!