ASA5516-X w/FirePOWER - Default Gateway

[michael.smith]

I'm setting up some ASA5516s, and I'm a little confused on the default gateway setting on the firepower module.

I've read that in 'inline' mode, you set the default gateway to the ASA5516 inside interface.  And in 'passive' or 'sniff' mode you set it to the routers (on the inside network) interface

I originally had it the default gateway set to the asa5516 inside interface, but could not reach it from a remote network...it was causing an asymmetric route.  I then changed the default gateway to the inside routers interface and everything is working fine.

The issue is i do not want to set up the firepower module in passive mode...i want it inspecting all the traffic and implementing any rules that it deems fit.

Am i doing this correctly?

[Guido Arturo Catalano]

SFR is a transparent device.

The default route is used for management/updates only.

[Marius Gunnerud]

As Guido has already mentioned, that default route is purely for management access and other management functions.  As for inline inspection the redirection is done via ACLs that are called in a policy-map configured on the ASA.  Communication between the ASA and SFR happen on the backplane.

[Florin Barhala]

Let's say I run out of license - or some bad configuration is applied through FMC server. If users start complaining - is it enough to disable SFR from global_policy ? Will it immediately release all previously inspected traffic?

Thanks!

[Marius Gunnerud]

Yes, I have had to do this several times as we ran into performance issues with 5585 running SFR modules. 

I have also done this during upgrades so I can do the upgrade during normal work day and not late night service window.

[Guido Arturo Catalano]

You can change the policy to monitor-only.
This way, SFR receive a copy of traffic but can't affect or block traffic.

class-map sfr
match access-list sfr_mpc

policy-map global_policy
class sfr
no sfr fail-open
sfr fail-open monitor-only