topic Re: Configuring a firepower 4300 FTD as a SDA fusion device in Network Security

Configuring a firepower 4300 FTD as a SDA fusion device

KelvinT — Fri, 21 Feb 2020 17:51:04 GMT

Hello,

Do anyone have documentation on how to configure a firepower 4300 FTD as a SDA fusion firewall?

Thanks

Re: Configuring a firepower 4300 FTD as a SDA fusion device

Marvin Rhoads — Thu, 23 Jan 2020 02:54:24 GMT

I haven't seen any specific guides. These whitepapers contain general guidance which you can adapt for the FTD-specific use case:

https://www.cisco.com/c/en/us/solutions/collateral/enterprise-networks/software-defined-access/white-paper-c11-741103.html

https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/Campus/CVD-Software-Defined-Access-Segmentation-Design-Guide-2018MAY.pdf

FTD doesn't support multiple contexts but is does support multiple instances.

Re: Configuring a firepower 4300 FTD as a SDA fusion device

KelvinT — Thu, 23 Jan 2020 03:50:49 GMT

Thanks Marvin for your reply.

I have seen the link you provide but it's kinda dated and refers to ASA firewall. As you probably already know FTD has SGT capabilities.

Re: Configuring a firepower 4300 FTD as a SDA fusion device

Marvin Rhoads — Fri, 24 Jan 2020 17:03:46 GMT

Yes the link is dated but the concepts remain the same. If there's an FTD-specific document, I haven't seen it - even in partner training.

Re: Configuring a firepower 4300 FTD as a SDA fusion device

KelvinT — Tue, 28 Jan 2020 19:29:21 GMT

Thanks Marvin

Re: Configuring a firepower 4300 FTD as a SDA fusion device

KelvinT — Tue, 28 Jan 2020 19:39:26 GMT

Oohh....gotcha Marvin! Hmmm...so with Firepower 4150 we can only create 4 instance max.

Okay. Thanks Marvin

Re: Configuring a firepower 4300 FTD as a SDA fusion device

Marvin Rhoads — Tue, 28 Jan 2020 21:30:02 GMT

Almost correct - 4150 supports 7 instances.

FTD Multi-Instance Scale

Although if you can wait until 6.6 you might see multiple VRF support.

Re: Configuring a firepower 4300 FTD as a SDA fusion device

KelvinT — Tue, 28 Jan 2020 20:42:01 GMT

Sorry. I think the number of containers for a 4150 is 7.

Could this be done with using sub-interface on one FTD instead of multiple containers?

Re: Configuring a firepower 4300 FTD as a SDA fusion device

Marvin Rhoads — Tue, 28 Jan 2020 21:24:09 GMT

Multi-instance, multi-VRF and separate zones are all ways to address the SDA fusion firewall needs. The last one is certainly easiest to implement and can be done via separate physical interfaces or subinterfaces.

Re: Configuring a firepower 4300 FTD as a SDA fusion device

KelvinT — Wed, 29 Jan 2020 02:38:39 GMT

Okay. That response created more questions. hahaha....

1- Can FTD do multi-VRF? I wasn't aware of this?

2- Will zone create seperate routing tables? Is seperate routing table a requirement for SDA fusion? Hmm.....

Thanks again Marvin

Re: Configuring a firepower 4300 FTD as a SDA fusion device

Marvin Rhoads — Wed, 29 Jan 2020 16:41:25 GMT

There's no VRF support as of the current release 6.5.0.2. We might see it in 6.6.

Creating zones won't create separate routing tables.

Whether or not you need that depends in part on your VN design in SDA. In any case you need to build the inter-VN policy (if any such is required ) and VN(s)-to-rest-of-the-world policies manually in the firewall. Generally you will need some ACLs with SGTs (VN-facing) and some more traditional 5-tuple ACLs (outside world facing).

I just confirmed the above at Cisco Live Barcelona this week.