topic Re: VTI on FTD in Network Security

VTI on FTD

giovanni.augusto — Fri, 21 Feb 2020 17:29:31 GMT

Hi Everyone,

I would like to know if it is possible to create a VTI on FTD to peer with cloud infrastructure or with other FTD with a S2S VPN and BGP running on top of it.

I know this works currently on ASA code since a long time so I would be very surprised if this was not done already in FTD

Thanks!

Re: VTI on FTD

Marvin Rhoads — Fri, 13 Sep 2019 05:49:42 GMT

Sorry but it's not currently possible (as of Firepower 6.4.0.4).

Re: VTI on FTD

giovanni.augusto — Fri, 13 Sep 2019 10:05:36 GMT

Thank you Marvin,

Do you know what is the solution to achieve VPN connectivity with public cloud and run BGP for dynamic routing updates considering on premises FTD as the VPN termination?

Re: VTI on FTD

Marvin Rhoads — Fri, 13 Sep 2019 12:15:20 GMT

You can either peer directly with the FTDv in the cloud using its dataplane interface or else use a CSRv instance.

Both options are shown here:

https://www.youtube.com/watch?v=PsicQ5RyrK8&t=288s

Re: VTI on FTD

giovanni.augusto — Fri, 13 Sep 2019 12:48:56 GMT

Thank you!

Can I run BGP on top of it?

Re: VTI on FTD

Marvin Rhoads — Fri, 13 Sep 2019 23:19:38 GMT

I'm not sure about your overall configuration. FTD (virtual or physical) supports BGP.

Re: VTI on FTD

giovanni.augusto — Fri, 13 Sep 2019 23:44:09 GMT

Thanks Marvin,

I currently have ASAs with VTI tunnels to Google GCP exchanging routes in BGP to Google cloud router and at some point I would like to migrate to FTD.

With ASA and VTIs is pretty straightforward but still I would like to know if this is a possible scenario and what would it be my BGP local address on FTD since in Google deployment is usually the VTI ip address, and that cannot be configured on FTD

Can I ask for a suggestion on how to proceed with FTD in this case? I have been looking at FTD documentation but nothing about this.

Thanks

Re: VTI on FTD

Marvin Rhoads — Sat, 14 Sep 2019 08:47:07 GMT

Do you have a Cisco account manager? It may be easiest if they can arrange a consultation with a Cisco Firepower SE or TME.

Re: VTI on FTD

robert.humphreys1 — Sun, 24 Jan 2021 22:04:33 GMT

Not yet tried, but Virtual Tunnel Interfaces (VTI) is now available on FTD 6.7 Cisco Firepower Release Notes, Version 6.7.0 - Features and Functionality [Cisco Firepower Management Center] - Cisco

We have been waiting for this feature to use Umbrella and some other cloud hosted services that require VTI. Though Umbrella has options for policy based we would prefer VTI with BGP.