topic Re: FQDN Objects on FTD in Network Security

FQDN Objects on FTD

Flavio Costa — Tue, 09 Jan 2018 12:04:37 GMT

Hi team,

Is it possible to create network objects using FQDN in FTD? Based on this statement I don't think it's possible: "In ASA, a network object can contain a host, a network IP address, a range of IP addresses, or a fully qualified domain name (FQDN). In the Firepower System, network objects support these same values with the exception of FQDN." https://www.cisco.com/c/en/us/td/docs/security/firepower/620/asa2ftd-migration/asa2ftd-migration-guide-620/asa2ftd_conversion_mapping.html

This is on the roadmap or will be considered to be implemented on FTD in the future? For customers that need to create FQDN-based rules that are moving from ASA to FTD, is there a design alternative? API or any workarounds?

Regards,

.:|:.:|:. Flavio Costa

CISCO Virtual Systems Engineer - Security

Sao Paulo, Brazil

flavicor@cisco.com

Re: FQDN Objects on FTD

yogdhanu — Tue, 09 Jan 2018 13:09:27 GMT

Hi There,

Currently FQDN objects are not supported. There is enhancement already raised for the issue but no ETA yet.

Here is the bug no.

CSCuv93558

Thanks,

Yogesh

Re: FQDN Objects on FTD

Flavio Costa — Tue, 09 Jan 2018 14:32:37 GMT

Thanks for the reply! So, currently there are no other ways to achieve the same goal?

Re: FQDN Objects on FTD

#Mat — Tue, 09 Jan 2018 15:10:22 GMT

Hi, you can use the URL tab in ACP. But you will need a license.

Regards.

Obtener Outlook para Android<https://aka.ms/ghei36>

Re: FQDN Objects on FTD

kfarhan — Wed, 18 Apr 2018 06:33:45 GMT

Hi,

Is there any documentation that tells how FQDN work flow in FTD since in ASA we can use FQDN in acl as destination but in FTD we can configure it as URL.

Re: FQDN Objects on FTD

tauseef.khan@scc.ccom — Thu, 19 Apr 2018 16:25:47 GMT

I think I saw something on cisco live like below:

Receive Packet ->Ingress Interface -> acl permit -> Match XLATE ->Policy Inspection ->NAT IP ->Egress Interface -> L3 Route -> L2 Address -> Transmit Packet

Also Check BRKSEC-2028 on Cisco live

Re: FQDN Objects on FTD

isaacalves27 — Thu, 22 Nov 2018 20:22:41 GMT

One solution would be to replace the fqdns by an app on the FMC.

Check video bellow:

https://www.youtube.com/watch?v=eWXEzULx-MA