topic Re: Cisco FTD inline set support for VLAN pairs in Network Security

Cisco FTD inline set support for VLAN pairs

SHABEEB KUNHIPOCKER — Mon, 19 Aug 2024 12:29:30 GMT

Hello Everyone,

I am migrating from a ASA with SFR module to aFTD running ASA image and another FTD running inline sets. The plan is to replace ASA with FTD running ASA image and SFR with an FTD running inline sets. In the current ASA we have around 31 sub interfaces and our target is to connect the FTD (running ASA image) and FTD (IPS) to a switch , then direct the traffic to IPS using VLAN pairs. Since there are sub interfaces in the ASA we would need the same in FTD inline sets to properly direct the traffic to the IPS so that the device connectivity can be done through a switch. Does the FTD support sub interfaces to configured as inline pairs or does it have something like VLAN pairs like old Cisco IPS?. What would be the approach I should follow in such a scenario?.

Kindly advise

Shabeeb

Re: Cisco FTD inline set support for VLAN pairs

ccieexpert — Mon, 19 Aug 2024 20:58:26 GMT

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/720/management-center-device-config-72/interfaces-settings-ifcs-ips.html

Inline sets and passive interfaces support physical interfaces and EtherChannels only, and cannot use VLANs or other virtual interfaces, including multi-instance chassis-defined subinterfaces.
But you should be able to define a trunk on switch connecting to the FTD and FTD can pass the VLANs seamlessly. this works just fine. since it is a inline pair it will just propagate the vlan just fine.

**Please rate as helpful if this was useful**

Re: Cisco FTD inline set support for VLAN pairs

SHABEEB KUNHIPOCKER — Mon, 19 Aug 2024 21:31:54 GMT

Hello,

Thanks a lot for your response. So we need to put the IPS physically between the switch and the ASA right?.

Re: Cisco FTD inline set support for VLAN pairs

MHM Cisco World — Mon, 19 Aug 2024 22:12:37 GMT

I am not so sure you need to try
SW(trunk)-link-FTD1 IPS-only-link-FTD2 with subinterface
FTD IPS-only not remove the header which include the VLAN

if it remove header then config
SW(access port)-link-FTD1 IPS-only-link-FTD2
here the IPS even if it remove the l2 header the traffic not drop

MHM

Re: Cisco FTD inline set support for VLAN pairs

ccieexpert — Mon, 19 Aug 2024 22:08:21 GMT

Correct.. put the FTD in the middle and it should work just fine.

**Please rate as helpful if this was useful**

Re: Cisco FTD inline set support for VLAN pairs

SHABEEB KUNHIPOCKER — Tue, 20 Aug 2024 14:19:47 GMT

Hello,

Thanks a lot for your reply. We have 3 segments, and I am planning to put the FTD inline pair in all the three segments. Please find the attached diagram.

I have the below concerns

If you take the traffic flow from server to internet, the traffic will be inspected first by the IPS layer placed in the inside segment of the ASA and then it will be inspected by the IPS layer placed in the outside interface of the ASA. Is there any way to avoid this double inspection?
Initially I was planning to build HA between the IPS FTDs but seems like with the above design it is not possible. If the ASA-01 is made standby from the CLI then the IPS-02 should become active which it will not as there will not be any interface failure. So in that scenario, IPS-01 and ASA-02 will be active and the traffic will be blocked. So either I need to add switches in every segment, or I will keep the IPS appliances as stand alone. Kindly advise what is the best practice.

Thanks

Shabeeb

Re: Cisco FTD inline set support for VLAN pairs

MHM Cisco World — Tue, 27 Aug 2024 08:10:35 GMT

Hi friend

Can we review your issue here,

Why you use ftd ips-only and ftd in series why you not use ftd and run IPS with it?

Did yoh have a load traffic?

MHM

Re: Cisco FTD inline set support for VLAN pairs

SHABEEB KUNHIPOCKER — Tue, 27 Aug 2024 08:16:19 GMT

Hello,

Thanks a lot for your reply. The customer currently has ASA with SFR modules. They have around 30 VPN tunnels in the firewall, and they are a bank. They would like to make sure the migration is very smooth. When we checked with local cisco team for design suggestion, they informed that FTD with ASA image + Separate FTD with IPS is the recommended design for banking customers.