About instances in the FTD

[m1xed0s]

First, I would like to say I hate the same word been re-used to represent different thing/features within the same product line...

I understand there is the multi-instance feature provided by 4k/9k FTDs which I belive is considered as contained based instances. This is pretty straight forward actually.

However within the individual FTD itself, if I check IPS/Dectection Engine log/statistics, there is "instance-#" shown/referenced...Obviously these "instance-#" are different than the multi-instance feature above and I think Cisco calls these as native instances (I might be wrong)...

So my questions:

1. what are the native instances represent? instances of snort?

2. different platforms (ASA vs FTD) that run FTD image, has different number of the native instances, right? Any datasheet type of reference regards?

3. Do more native instances mean potential better performance?

Thanks,

[balaji.bandi]

FP 4K or 9K

The base is FXOS  - on top you have any instance example - ASA 1 instance and FTD another instance.

All shared with common infrastructure as a hardware, but different isolated instances (just like exsi - vm)

Depends on the requirement of deployment, big enterprise service providers, run one instance due to traffic requirement

it can be FTD or ASA depends on choice (most cased FTD since this is next Generation FW)

here is a good reference :

https://www.cisco.com/c/en/us/td/docs/security/firepower/fxos/multi-instance/multi-instance_solution.html

Good Cisco live presentation also for reference :

https://www.ciscolive.com/c/dam/r/ciscolive/apjc/docs/2019/pdf/BRKSEC-3035.pdf

[m1xed0s]

Thanks for the info. But that’s not what I am looking for…

[balaji.bandi]

Thanks for the info. But that’s not what I am looking for…

what did we miss here ? explain?

[m1xed0s]

As stated in the post, I want information on the native ”instance-#” as shown within the individual FTD itself, if I check IPS/Dectection Engine log/statistics.

[Marvin Rhoads · Accepted solution]

The detail you are seeing is the number of Snort (IPS engine) instances running. That is completely separate from the"multi-instance" feature of running separate FTD instances in containers on a 4100 or 9300 series firewall. Those are known as container instances.

You can see the number of Snort instances at a given time with "show snort instances" from the cli.

https://www.cisco.com/c/en/us/td/docs/security/firepower/command_ref/b_Command_Reference_for_Firepower_Threat_Defense/s_8.html#wp1166799110

The varying hardware models support increasing numbers of Snort instances in a parallel processing scheme to increase throughput of the system.

[m1xed0s]

Thanks! So if these instance-# is only for snort,

1. Is the instance-# corresponding to the CPU core, for example on a FTD2130 box?
2. What about the Lina engine or prefilter? Does it get instance associated with CPU Cores as well? 

[Marvin Rhoads]

I don't have the figures for a 2130 handy (except that it has only 8 CPU cores total), but if we look at Andrew Ossipov's BRKSEC-3035 Cisco Live presentation from Barcelona 2020, we can see a Firepower 4115 for example. It has 46 CPU cores: 16 for data plane (roughly maps to LINA functions including prefilter, NAT, routing, etc.), 28 for Snort and 2 for system (FXOS hardware management etc.).

[m1xed0s]

Okey, thanks!