topic Re: FTD VPn Question in Network Security

FTD VPn Question

benolyndav — Tue, 03 Oct 2023 10:30:57 GMT

We have an FTD with Global and 3 Virtual Routers(vrf) configured on it all these use the same default route via Global Inet connection,

Is it possible for me to esatablish a VPN from the Inet facing Interface and allow only one VRF's traffic across the VPN, So basically this VRF would now send all its traffic via the VPN.??

Thanks

Re: FTD VPn Question

Rob Ingram — Tue, 03 Oct 2023 10:44:59 GMT

@benolyndav what version of FTD are you using? Are you using a Policy or Route Based VPN (VTI)?

The latest version 7.3/7.4 supports user-defined virtual routers (VRFs) for VTIs

Re: FTD VPn Question

benolyndav — Tue, 03 Oct 2023 11:31:02 GMT

We are using Policy Based VPN

Thanks

Re: FTD VPn Question

Rob Ingram — Tue, 03 Oct 2023 11:35:50 GMT

@benolyndav unfortunately I do not believe virtual routers (VRF) are supported using policy based VPNs, only routed based VPN (VTI) appear to support VRF.

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/720/management-center-device-config-72/vpn-s2s.html

Re: FTD VPn Question

benolyndav — Tue, 03 Oct 2023 11:48:07 GMT

So the vpn is between the outside interface and the 3rd party peer the outside interface is in the gloal routing I would add the traffic to the vpn and add a static route in the vrf any-ipv4 to internet which is leaked from global, are you saying that wouldnt work ??

Thanks

Re: FTD VPn Question

Rob Ingram — Tue, 03 Oct 2023 12:14:03 GMT

@benolyndav so if the VPN is in the global routing table, then routing leaking from a user-defined vrf should work.

I assumed you wanted to use user-defined VRF for VPNs, which is not supported unless using a VTI (on newer FTD versions).

Re: FTD VPn Question

MHM Cisco World — Tue, 03 Oct 2023 13:26:03 GMT

Friend it work use pbr and forward traffic via vpn.

Did you check this solution?