topic Re: Rate limiting FTD's own traffic in Network Security

Rate limiting FTD's own traffic

cpaquet — Mon, 31 Jul 2023 23:14:08 GMT

Is there a way to rate limit the traffic generated by the FTD itself? Example: if VoIP is going through the Firewall, can we prioritize VoIP over the events traffic generated by the FTD itself?

I'm familiar with the QoS feature of FTD which permit basic rate limitation by assigning maximum throughput on user traffic. Is there a way we could use the FTD QoS feature to limit the outbound traffic a FTD is sending to the FMC, by, example limiting the traffic to FMC TCP/8305?

Or is the FTD like the ASA: It filters user traffic, but not the traffic generated by the FTD itself?

Thanks.

Re: Rate limiting FTD's own traffic

rhingel — Tue, 01 Aug 2023 00:27:22 GMT

Hello,

The feature you mean would be Control Plane Policing (CoPP), that is something that does exist on Cisco IOS, but it is not relevant to FTD.

The FTD has build-in control to protect it's control plane, the QoS rate limit you mean would affect the data plane.

Re: Rate limiting FTD's own traffic

cpaquet — Tue, 01 Aug 2023 13:44:57 GMT

Could you expand on the built-in control plane mechanisms in FTD to prevent overloading the system?

A more drastic approach, which would not be useful, but does provide strict control-plane control is using FlexConfig with the access-group xxxx control-plane command.

Re: Rate limiting FTD's own traffic

Rob Ingram — Tue, 01 Aug 2023 13:51:04 GMT

@cpaquet I am not aware of rate-limiting availability on the FTD control plane, but if you used a dedicated management interface instead of a data interface for communication to/from the FMC, then that management event traffic would be isolated.

Re: Rate limiting FTD's own traffic

rhingel — Tue, 01 Aug 2023 13:53:47 GMT

I am trying to think of an use case where you need to rate-limit the communication between the FTD and FMC, can you ellaborate on your requirement?

Re: Rate limiting FTD's own traffic

MHM Cisco World — Tue, 01 Aug 2023 14:04:16 GMT

Hi'

There are two QoS'

QoS of VoIP pass through FTD which applies to interface

But how QoS of VoIP generate from FTD itself? That you need to elaborate.

Thanks

MHM

Re: Rate limiting FTD's own traffic

cpaquet — Tue, 01 Aug 2023 16:56:42 GMT

Example: In a data center (clustering, LISP, etc), where you are doing extension FTD logging to the FMC, but also you have multiple critical user applications. How would you configured the FTD to give precedence to user applications if there is contation for the bandwidht? Thus the possible need to throttling the FTD 'self-traffic'.

Re: Rate limiting FTD's own traffic

cpaquet — Tue, 01 Aug 2023 16:57:09 GMT

Good point. Thanks.

Re: Rate limiting FTD's own traffic

MHM Cisco World — Tue, 01 Aug 2023 17:16:04 GMT

Aasume you have upload 100 and download 500 and you want to give 25% to VoIP

So you can try add to QoS policy

One for app VoIP give it 25 and 125

And other for any IP give 75 and 375.

I am not sure it work but I dont think fpr have QoS like router and SW.

Re: Rate limiting FTD's own traffic

Rob Ingram — Tue, 01 Aug 2023 17:37:59 GMT

@cpaquet wrote:

Example: In a data center (clustering, LISP, etc), where you are doing extension FTD logging to the FMC

@cpaquet you can rate limit syslog traffic, this can be configured via platform settings policy and deployed to the managed FTD. https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/200479-Configure-Logging-on-FTD-via-FMC.html#toc-hId--41694258

I believe QoS will only apply to traffic "through" the FTD, not "to" (traffic to/from the FTD itself).

Re: Rate limiting FTD's own traffic

MHM Cisco World — Tue, 01 Aug 2023 17:47:38 GMT

He is confused about data pass or initiate from FTD. I think meaning pass through ftd so he need qos policy.

Re: Rate limiting FTD's own traffic

cpaquet — Tue, 01 Aug 2023 20:48:24 GMT

Hi Rob, excellent suggestion to use syslog rate limit, if throttling for FTD 'self-traffic' is not available.

Re: Rate limiting FTD's own traffic

cpaquet — Tue, 01 Aug 2023 20:51:58 GMT

@MHM Cisco World : Rob is not confused. He understand perfectly my original question which is: how can we throttling the traffic generated by FTD itself. This is considered traffic 'to/from' the firewall, and not traffic through the firewall.