Wildcard or variables in Access Policies on FTD

[neroshake]

Hello,

Is there any way to achieve implementation of wildcard masks or variables in IP addresses in FTD? Particularly for example I need to create a policy to deny the traffic from particular host to IP addresses ending with .121 in all our branches (there are 70 branches with subnets like 192.168.10.0/24, 192.168.11.0/24, 192.168.13.0/24, etc). I want to accomplish this by creating a single rule? The oprion of creating 70 network objects is also not convenient.

Thank you!

[Meheretab Mengistu]

Hi,

Yes, you can apply wildcard mask to filter specific hosts from different networks. For example,
if you have 192.168.11.0/24, 192.168.13.0/24, 192.168.14.0/24,..., and you choose to allow only to one host in each network (192.168.x.121), run the following command:

access-list 1 permit 192.168.0.121 0.0.255.0

What you basically did is that you want to match 192.168 and 121, but not the 3rd octet.

Please rate it if you find it helpful : )

HTH,
Meheretab

[neroshake]

Thank you, meheretabm!

My deployment is a HA of two FTDs managed by FMC. Where I should enter that ACLs and how do I connect them with Access Policies?

Thanks.

[Marvin Rhoads]

The earlier respondent was thinking about ASA and/or router ACLs. Unfortunately FTD does not currently have 100% feature parity with ASA - even in something as basic as ACLs.

An FTD / FMC standard or extended access-list entry does not currently (as of 6.2.2) permit non-contiguous netmasks such as you would have to use here to specify all of the .121 hosts with a single object.

You can't even work around by using flexconfig as the access-list command is blacklisted from flexconfig.

I believe the only method is to create all of the individual /32 entries as network objects and then combine them into a group which you can then use in your policies.

[Jesper Erbs2 · Accepted solution]

Hello Neroshake,

Wildcards are not currently supported in the Firepower Threat Defense or the ASA.

I would create a group and add them individually to the group - Thereby you save time by not having to create 70 network object. See the example below:

[Jesper Erbs2]

Or use scripting and REST API, but that will take longer than the above if you have no experience with it. :)