5516 on FTD

[GRANT3779]

Hi CSC,

When installing FTD on a 5516 ASA, is the traffic flow the same as it would be when the firewall was running Traditional ASA software and the FirePOWER software separately?

In the past when running ASA with FirePOWER, we would send traffic to SFR via policy-map. How is this done in the ASA when it runs FTD?

[Marvin Rhoads]

An FTD appliance (on ASA or on Firepower hardware or virtual) follows a different order of operations. FTD has a unified image so there's not separation of ASA and FTD image bits.

Under the covers, you still have the firewall engine (Lina) and the presence of L3/4 ACLs in it. You have the option to bypass the Firepower engine (Snort etc.) via prefilter policy with Fastpath rules.