Firepower 2110 configuration

[David Ettinger]

I have a Firepower 2100 firewall running FDM.   I am having trouble getting any data through the firewall.   I'm not a networking guru but have a good knowledge of networking.   

I have a simple configuration:   On the inside I have a single computer, 192.168.0.21/16.  On the outside I have single computer, 192.168.2.20/16.   When I connect these two computers directly I can ping without issue so I know the interfaces are working.   I have two Security Policies:  let any network traffic from the outside pass to the inside and vise versa so I don't believe the firewall is blocking anything.   Since I don't have a router on either side of the firewall interfaces, I'm not sure how to set up a static route that will allow traffic to be routed between the inside and outside interfaces.   Right now I'm just pinging 192.168.0.21 from the outside computer and also using a packet sniffer on the inside computer to look for any traffic.   Thanks for any help you can provide.

[Flavio Miranda]

Hi

   You dont need route if the firewall have both interface on the respective network. If you put the Inside interface with IP address 192.168.0.1 255.255.255.0 and on the  outside you put 192.168.2.1 255.255.255.0 then Firewall will be able to pass traffic from one PC to another with no problem. If traffic is allowed.

192.168.0.0/16 and 192.168.2.0/16 are on the same network, so, do use it. 

The range would be 192.168.0.1 - 192.168.255.254

If you want to use /16 then use 192.168.0.0 and 192.169.0.0

[David Ettinger]

That's exactly the configuration I have right now.   The traffic should be allowed as I have:

Allow:  Source: inside_zone, any network, any port    Destination: outside_zone, any network, any port

Allow:  Source: outside_zone, any network, any port   Destination:  inside_zone, any network, any port 

Also, wouldn't blocked traffic show up on the dashboard?   

[Flavio Miranda]

It would log. 

But look. You said above:

"I have a simple configuration:   On the inside I have a single computer, 192.168.0.21/16.  On the outside I have single computer, 192.168.2.20/16."

It wont work as both interface is on the same network. You need to change the mask to 255.255.255.0.

 The firewall need to have interfaces on different network. 

[David Ettinger]

Thanks Flavio for the quick responses.   So I changed the netmask on both ends but still no ping response on the outside nor anything showing up on a packet sniffer on the inside.   Also tried to reverse the roles and ping from the inside.   On the FDM dashboard I see nothing on the throughput display nor any events.

[Flavio Miranda]

Check if PC are properly configured with default gateway. 

 For test purpose, create another inside interface and try it. If ping, you know that it id about rules. 

[MHM Cisco World]

The outside PC must have defualt gw whcih is fpr outside interface ip

The inside pc must have defualt gw whcih is fpr inside interface ip

[David Ettinger]

My Linux computers 'netstat -r' show:

Outside (Redhat 6)

Destination      Gateway              Genmask             Flags     Interface

192.168.2.0    *                         255.255.255.0      U          eth0

default             192.168.2.254   0.0.0.0                  UG        eth0

Inside (Redhat

Destination      Gateway              Genmask             Flags     Interface

default             _gateway            0.0.0.0                  UG        enp2s0

192.168.0.0    0.0.0.0                255.255.255.0      U          enp2s0

It is interesting now that I've done this, I can no longer connect the two together (bypassing the firewall) and ping.

[MHM Cisco World]

Just take one min and rearrange all subnet mask in both PC and inside/outside interface of fpr all must have /24 subnet mask and all must have unique IP address.

Please add correct defualt gw IP in both PC

[David Ettinger]

My FPR interfaces do not have IP addresses assigned.   Didn't know that would be required.

More info:   With the above network configuration, when I hook the two computers direct (firewall bypassed), if I ping the outside from the inside computer and put a packet sniffer on the outside computer, I see ARP requests from the inside computer but I see no ICMP packets and no response from the ping on the inside computer.

[MHM Cisco World]

Friend since both pc in different subnet you need ip for fpr interface'

The fpr will routing between two subnet.

[David Ettinger]

I just added 192.168.2.1/24 to the outside interface and 192.168.0.1/24 to the inside interface.   No change.

[MHM Cisco World]

Ate these IP what you use for GW in both PC ?

[David Ettinger]

Bingo!    That was the problem.   Changed the default gateways on the PC to their respective FPR interface and it works!

So here is another question:    In my deployed configuration I'll have a bunch of PCs all connected to a layer 2 network switch within a VLAN.   They will all have 205.19.x.x/16 addresses.   One of these computers currently comes in from the "outside" and the intent was to connect the firewall between the network switch and the "outside" computer.  Given this working configuration I'm thinking this firewall might not handle this.   Thoughts?

[MHM Cisco World]

No same lab we make it work above can apply to your network with SW and one PC outside.

Do same steps and make sure you assign correct GW in PC in both side of FPR.

MHM