ASA 5516-X with FirePOWER services Firewall engine

[marine253]

Hello Team,

I am failing to understand how the firewall engines works when ASA is combined with FTD.

Is there like a double layer of firewall? Lets say that i want to allow HTTP traffic from my lan (192.168.1.100) towards 1.1.1.1 on the internet.

Should i allow it on ASA and on FTD? 

Does ASA scan it first then FTD?

I was working on a ASA 5516-X with FirePOWER services Firewall recently and i allowed the traffic correctly , but services were not working. Then i realized that FTD was blocking the traffic.

Can someone please shed some light here?

How is NAT performed? Is it an either or configuration? Or is NAT only performed at ASA level?

Thanks

[Francesco Molino]

Hi

You have asa and firepower service module, right? Not the unified image FTD?

The traffic should be allowed on asa for the L3 and L4 part. The nat is done on asa.

If you have a policy to inspect your traffic (L7 inspection) then it goes in your firepower service module and you should also allow it there.

Here a picture showing the traffic flow: