topic Re: FTD support multiple instance in Network Security

Multi Context FTD

simon_efi_scante — Tue, 12 Mar 2019 09:44:26 GMT

Hi,

I must configure a new FPR 4110 and I need to configure in it a multi context.

I have read that for the moment Firepower Threat Defense doesn't support Multi Context, it's only supported with ASA.

I want to use the features of NGFW with Multi Context, how can I do that?

In the next release of FTD will be supported Multi Context?

Thank you so much

Hi,

Aditya Ganjoo — Wed, 26 Jul 2017 11:00:14 GMT

Hi,

Until now we do not have any information on this.

If you install ASA on FPR only it can be used in the multiple context but not FTD.

Regards,

Aditya

Please rate helpful and mark correct answers

FTD support for multiple

Marvin Rhoads — Wed, 26 Jul 2017 14:59:18 GMT

FTD support for multiple context is planned for a future release but the release is not yet confirmed. I wouldn't expect it this year (2017).

There are alternatives such as security zones that may address the use case that led you to want multiple contexts. If you can share the functional requirements we may be able to suggest a way to satisfy them.

Re: FTD support for multiple

#Mat — Mon, 06 Nov 2017 17:39:50 GMT

Hi Marvin!, how can we deploy the workaround with security zones?

Thanks!

Re: FTD support for multiple

Gus Rosa — Mon, 20 Nov 2017 20:34:16 GMT

Re: FTD support for multiple

Marvin Rhoads — Mon, 05 Feb 2018 12:07:10 GMT

If multiple contexts are only to separate tenants' or departments' traffic administratively and security-wise you can simply define them as separate zones and keep their traffic separate by not allowing traffic between the zones.

Only if you need features like support for independent distinct routing tables (potentially with overlapping address space) and delegated management without the ability to see other tenants would you need multiple contexts. In such a case, Cisco advocates putting traditional multiple context ASA "in series" with Firepower appliances to get all the features of both products.

Personally I believe this is a bit more complexity and cost than should be necessary to meet the functional requirements but it will work.

Re: FTD support for multiple

jaime.pedraza — Thu, 15 Mar 2018 19:06:07 GMT

Hi Marvin,

¿Have you heard any update about the multi context feature on Firepowers?

Thanks!

James

Re: FTD support for multiple

Marvin Rhoads — Sat, 17 Mar 2018 04:56:53 GMT

There's been no update from Cisco.

I know they are aware that it is an in-demand feature from many customers but they have not yet made any public commitment to deliver it.

If it's important to your organization or your customers then I strongly suggest you make sure your Cisco account manager knows that. The more customers asking for it, the better the business case inside Cisco for making it a higher priority.

Re: FTD support for multiple

bernardovr — Mon, 19 Mar 2018 18:30:37 GMT

Hi Marvin,

Is this possible now? or we must wait.

Thanks

Re: FTD support for multiple

Marvin Rhoads — Tue, 20 Mar 2018 03:18:01 GMT

There's no update since I last posted 72 hours ago.

The feature is not available in Firepower 6.2.2.

Watch the release notes as new versions come out - that will be the definitive source for this information.

https://www.cisco.com/c/en/us/support/security/defense-center/products-release-notes-list.html

Re: FTD support for multiple

eniola@ipconstruct.co.uk — Wed, 19 Sep 2018 18:37:49 GMT

Is there any guidance on separating multiple tenants into security zones on the ASA as you suggested . I thought the Zone based deployment model only applied to router based firewalls.

Re: FTD support multiple instance

robert.humphreys1 — Fri, 07 Dec 2018 13:03:28 GMT

https://www.cisco.com/c/en/us/td/docs/security/firepower/630/relnotes/firepower-release-notes-630.html

Hello,

Cisco have just released Firepower 6.3.0 as of Wednesday, 5th December. Multi-instance is now available.

Re: FTD support multiple instance

chartech0 — Thu, 16 May 2024 12:11:08 GMT

It is now 2024. Does FTD yet support multiple contexts yet? It seems multiple instances complicate the process. I have heard finally in release 7.2.0+ finally supports Anyconnect. ASA does not support Firepower on 2110 platform only FTD. I need a solution to support anyconnect, multiple contexts and firepower. Does this exist yet?

Re: FTD support multiple instance

Marvin Rhoads — Thu, 16 May 2024 12:35:11 GMT

FTD does not now nor will it ever support contexts. Multi-instance with FTD is the way to support similar features.

Remote access VPN with AnyConnect (or Secure Client as it is now known) has been supported on FTD for years now - well before version 7.2.x.

Re: FTD support multiple instance

chartech0 — Thu, 16 May 2024 12:45:17 GMT

Is there another model above the 2110 that in ASA mode would support multiple contexts, firepower and anyconnect. The only reason I am upgrading/replacing my 5525x multitenant solution is because Cisco has EOL it pretty much without a 1-1 solution. I will have to move up to a 4110 to get 20+ Multi-instances.

Re: FTD support multiple instance

Marvin Rhoads — Fri, 17 May 2024 13:07:50 GMT

ASA image running on Cisco "Firepower" or Secure Firewall appliances does not and will not support NGFW features such as were available with Firepower service modules on the old platforms. This is the case no matter which model of hardware and will not be changing. Theoretically you could have a larger platform running multiple logical devices, one with ASA and one with FTD, and chain them together but I have never seen anyone actually do this.

Re: FTD support multiple instance

chartech0 — Thu, 16 May 2024 13:37:52 GMT

So theoretically, I could have an instance running FTD solely as my IPS and run another instance as ASA with all my contexts and VPN? Would this run on an HA pair?

Re: FTD support multiple instance

chartech0 — Thu, 16 May 2024 14:08:34 GMT

It looks like utilizing a 3110 and FMC, I can have 2 instances where I could have a FTD running Firepower and Secure Client and have a 2nd running Asa and having my contexts linking the interfaces physically together.

Re: FTD support multiple instance

Marvin Rhoads — Thu, 16 May 2024 14:27:07 GMT

The case of running both ASA and FTD on a single physical chassis is only supported on a 9300 chassis with multiple security modules. It's not technically multi-instance since the security modules on that platform are technically independent computers sharing a common chassis for power and system management.

Reference: https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/740/management-center-device-config-74/device-ops-logical-devices.html#reference_vcy_dkx_22b

Support for ASA and threat defense on separate modules of the same Firepower 9300

6.4

Any

You can now deploy ASA and threat defense logical devices on the same Firepower 9300.

Note

Requires FXOS 2.6.1.157.

Re: FTD support multiple instance

Marvin Rhoads — Thu, 16 May 2024 14:30:20 GMT

No - a 3100 series only supports Threat Defense images (FTD) in multi instance mode:

"each instance runs separate threat defense images"

Source: https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/740/management-center-device-config-74/device-ops-multi-instance.html#multi-instance-mode-vs.-appliance-mode