hi all
we have dual homed internet in our Internet Edge firewall (firepower FTD FDM 6.2.3).
both of them running NAT publishing for different application, for example : application A (segment 0) and application B (segment 9), application A using nat via Provider A (ip public segment A), and application B using nat via provider B (ip public segment B).
We know the solution is using PBR, we try to input PBR config via flexconfig (the only one way to deploy the configuration).
here it is our config editor :
access-list AppA permit ip 192.168.0.0 0.0.0.255 any
access-list AppB permit ip 192.168.9.0 0.0.0.255 any
route-map PBR permit 10
match ip address AppA
set ip next-hop a.a.a.a
route-map PBR permit 20
match ip address AppB
set ip next-hop b.b.b.b
route-map PBR permit 30
interface Ethernet1/1
policy-route route-map PBR
and we're using flexconfig object to make that config deployed. the config deployed with error.
but the thing is, access-list object doesnt appear on running configuration (although other object and command is appear) in Firepower. We check it via Console. So the traffic of all segment including dmz, outside, inside (segment A and segment B) etc can not be ping and access by each other. actually before connecting IP public B and do PBR, ip public A running well on Firepower machine. Since we deploy a new connection for ip public segment B (migration phase) and input those command, everything goes wrong.
is there any solution for my case? since we know that ACL object is not entered, but other object including interface pbr configuration seems like enforced to enter to my FP
is there a Firepower FDM limitation?
please help me
