topic Re: Firepower Networking issue between interface port in Wireless

Firepower Networking issue between interface port

eeebbunee — Thu, 18 Nov 2021 19:46:01 GMT

Hello Engineers,

Today I found there is critical security issue on our Firepower. (2110 series)

On our Firepower, there are 3 interface ports, Outside/Inside/Guest.

Those IP ranges has different, and Inside/Guest has private IP ranges.

Guest interface is for wireless Guest users.

Normally Guest users are not able to access Inside IP blocks, can't communicate with each other.

My case, Guest IP range can communicate with Inside!!!!!!!!!

-There is no route for guest interface and Guest zone in Firepower.

-There is no route for Guest IP range in Core switch.

I don't know where should I check... Please help, it is urgent to me..

How can different interface port can communicate without routing??

I really appreciate your comments.

Re: Firepower Networking issue between interface port

balaji.bandi — Thu, 18 Nov 2021 19:56:05 GMT

Each port runs different VLANs in the switch where they are connected, you should not see this issue?

how is your switch configured?

Try to access from Guest user to Inside, check the Logs in firepower is this reaching firepower or switch doing any routing here?

Re: Firepower Networking issue between interface port

kapydan88 — Fri, 19 Nov 2021 14:59:10 GMT

Hello.

Can you share screen from your Firepower 2110? How it is managed - via FMC or FDM?

Are you sure, that cause of this problem inside Firepower? Maybe you need to implement ACL inside your core-switch or any L3 device.

Re: Firepower Networking issue between interface port

eeebbunee — Mon, 22 Nov 2021 17:23:41 GMT

Hello Balaji,

Yes, Guest and inside port from FTD are connected to Core switch with different vlan.

WLC1/1-1/4 ports (Trunk)==== Core switch po1 LAG

* WLC guest-interface VLAN300, ip address 192.168.0.2 / 255.255.255.0 / 192.168.0.1

Core switch inside ==== FTD Ethernet1/2

Core switch Guest(VLAN300, no int vlan 300 ip address) ==== FTD Ethernet 1/3 (192.168.0.1)

FTD DHCP Server enabled for Guest Network (192.168.0.3-192.168.0.200)

When I connect Guest wireless, I get IP from FTD and connect internet.

We have other site office, same configurations (almost similar) (FTD,Core switch, WLC). There, without no access-list (deny) rule in Core switch, guest network is not able to communicate with inside networks.

Do you think that's because of Core switch or WLC? (not FTD)?