topic Re: Deploy Firepowr 2140 as IPS-Only Mode in HA in Network Security

Deploy Firepowr 2140 as IPS-Only Mode in HA

Ramkumar1988 — Tue, 12 Mar 2019 14:01:09 GMT

Is there way to configure the Firepower 2100 as NGIPS in HA. We need to deploy FPR 2140 without making any routing changes in adjacent devices.

I can see the options only for Routed/Transparent Mode .

Re: Deploy Firepowr 2140 as IPS-Only Mode in HA

Marius Gunnerud — Sat, 06 Oct 2018 09:18:27 GMT

Have a look at this link for HA configuration for NGIPS firewalls.

https://www.cisco.com/c/en/us/support/docs/security/firepower-management-center/212699-configure-ftd-high-availability-on-firep.html

Re: Deploy Firepowr 2140 as IPS-Only Mode in HA

Ramkumar1988 — Sat, 06 Oct 2018 09:26:13 GMT

Thanks for the update . Am looking for 2140 as IPS-only to introduce in Network with HA

Re: Deploy Firepowr 2140 as IPS-Only Mode in HA

Marius Gunnerud — Sat, 06 Oct 2018 10:18:37 GMT

The document is for FTD 9000 series but the configuration remains the same for 2140 also.

Here is a link for HA for FTD4100 but as mentioned configuration is the same for 2140.

https://finkotek.com/cisco-4100-firepower-threat-defense-deploying-activestandby/

Re: Deploy Firepowr 2140 as IPS-Only Mode in HA

prabakar1988 — Sun, 07 Oct 2018 10:20:55 GMT

Thanks Again ... Its explains about the HA part and am still looking for the options to enable IPS-Only Mode

Re: Deploy Firepowr 2140 as IPS-Only Mode in HA

Marvin Rhoads — Mon, 08 Oct 2018 08:32:17 GMT

What you are asking about is referred to as an inline pair transparent mode deployment.

Please see the following references for implementation details:

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/200924-configuring-firepower-threat-defense-int.html

https://www.cisco.com/c/en/us/td/docs/security/firepower/hw/firepower_device/firepower_7k8k_device/deployment.html#pgfId-1098121

Re: Deploy Firepowr 2140 as IPS-Only Mode in HA

Ramkumar1988 — Mon, 08 Oct 2018 08:47:51 GMT

Hi Marvin,
Yes .. exactly . This is what i am looking for .Also i worked in 8300 IPS where i am gonna configure the same features in 2100 . Thanks a lot for your response. Is there difference enabling the Inline Mode in Routed/Transparent mode. I guess both Modes will not require any adjacent device configuration . Any specific reason to choose Transparent .

Also HA will be work like a FTD (since we are going to use it only for IPS)

Re: Deploy Firepowr 2140 as IPS-Only Mode in HA

Marvin Rhoads — Mon, 08 Oct 2018 10:02:38 GMT

The overall firewall can be routed or transparent.

Either way, as noted in the first link I provided: "When you configure an Inline Pair 2 Physical interfaces are internally bridged."

You're correct - they essentially act as a "bump in the wire" with IPS functionality.

Re: Deploy Firepowr 2140 as IPS-Only Mode in HA

Ramkumar1988 — Mon, 08 Oct 2018 10:27:59 GMT

Thanks again Marvin! Is there any befit by configuring HA as I am going to use full IPS features set .

Re: Deploy Firepowr 2140 as IPS-Only Mode in HA

Marvin Rhoads — Mon, 08 Oct 2018 17:09:40 GMT

Well HA gives you just that - High Availability.

As of right now we don't have the option of Fail-To-Wire (FTW) interfaces on the 2100 series. So if the single unit fails, your traffic through it will be blocked.

Re: Deploy Firepowr 2140 as IPS-Only Mode in HA

Ramkumar1988 — Tue, 09 Oct 2018 04:53:03 GMT

Data sheet for 2100 depicts that there is a FTW network module available for this platform . I am checking with Cisco to identify the appropriate modules.

https://www.cisco.com/c/en/us/products/collateral/security/firepower-ngfw/datasheet-c78-736661.html

Also We will be deploying the Inline mode and will HA really help(will it be monitor the interface modules to initiate the failover ) . I assume we dont need any sync interface between the Pair (as its a NGIPS) and kind of lan based failover.

Re: Deploy Firepowr 2140 as IPS-Only Mode in HA

Marvin Rhoads — Tue, 09 Oct 2018 15:34:54 GMT

They did announce the FTW interfaces for the Firepower 2100 series but I don't believe they are shipping yet. I just checked the Cisco ordering tool and they don't show up as available in a Firepower 2140 NGFW configuration.

Building an HA pair will still require a failover link between the two appliances.

Re: Deploy Firepowr 2140 as IPS-Only Mode in HA

Ramkumar1988 — Tue, 09 Oct 2018 16:13:42 GMT

Might be ! I couldn't see any FTW module from FXOS cli..also The failover will be in LINA engine ?

Basically the device data interface will not have any IP address assignment and will be able to monitor/initiate failover ?

Re: Deploy Firepowr 2140 as IPS-Only Mode in HA

Marvin Rhoads — Tue, 09 Oct 2018 16:17:05 GMT

Correct the data plane interfaces don't have IP addresses in your use case.

The failover interfaces can be thought of as control plane. They will send heartbeats and other status along with configuration synchronization between the two appliances.

Re: Deploy Firepowr 2140 as IPS-Only Mode in HA

Ramkumar1988 — Mon, 15 Oct 2018 04:02:57 GMT

Thanks Marvin .. I am sorry for the delayed Response ...