topic Re: Is FTD’s control plane wide open? in Network Security

Is FTD’s control plane wide open?

guacamoley — Sun, 11 Feb 2024 13:57:40 GMT

I was looking into setting up BGP on an ftd and was wondering where to allow TCP179 and then I realized there is nowhere to even add this as an access entry. Same goes for VPN. Is this not wildly insecure?

Re: Is FTD’s control plane wide open?

MHM Cisco World — Sun, 11 Feb 2024 14:03:07 GMT

https://integratingit.wordpress.com/2021/06/26/ftd-control-plane-acl/

In FTD using control -plane done via flexconfig

Check link' I alos will check new versions of fdm and fmc if there is option to add it directly.

Thanks

MHM

Re: Is FTD’s control plane wide open?

Rob Ingram — Sun, 11 Feb 2024 14:03:11 GMT

@guacamoley you can use the control-plane ACL functionality to restrict access "to" the FTD such as BGP, currently you must use FlexConfig to configure this.

https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-threat-defense/221531-configure-control-plane-access-control-p.html

Re: Is FTD’s control plane wide open?

tvotna — Sun, 11 Feb 2024 15:40:37 GMT

As @Rob Ingram and @MHM Cisco World mentioned, you can use "access-group <name> in int outside control-plane" to control who can access TCP/179. Obviously, it is practically impossible to do the same for TCP/443, although technically control-plane ACLs do work for TCP/443 too. This means that TCP/443 is wide open and the firewall doesn't have protection for TCP/443.

Also, if you, for example, try to rate-limit TCP/443 messages to protect device from DoS, you'd find that none of ASA features work:

- "class-map type management" doesn't allow you to limit connections or embryonic connections per-host in the corresponding policy-map
- "class" and "member" constructs do not limit to-the-box connections in case of multiple context mode (on ASA), hence "limit-resource rate" doesn't work too (this tool is unavailable on FTD as it doesn't support multiple mode)
- MPF is not capable of connection rate-limiting at all.

HTH

Re: Is FTD’s control plane wide open?

guacamoley — Sun, 11 Feb 2024 21:19:01 GMT

Doesn't the FTD have its own DDOS protection with the Network Analysis Policy?

Re: Is FTD’s control plane wide open?

Rob Ingram — Sun, 11 Feb 2024 21:27:17 GMT

@guacamoley the NAP is for traffic "through" the FTD not "to".