I have a firepower 1010 managed with FDM. I have a default config with routed interfaces. Shouldnt the interfaces route between each other by default if they are in the same security zone? The only think i can think of is that I have my fiber modem in passthru mode and it assigns the WAN ip by DHCP but its a WAN gateway so it cant route my internal IPV4?
Solved! Go to Solution.
@thediscountgeeks correct, the router would behave differently and would allow the ping. You have a security device, both the FTD or ASA will not allow the ping through the device to one of it's local interfaces.
You inital issue is resolved now?
Your default ACP rule is to block. So unless the traffic is explicitly allowed in an earlier rule it will not be allowed.
You didn't share the interface-one mapping but the rules you have do not appear at first glance to cover all of the many interfaces you have configured.
You can always confirm a given flow's behavior from the cli using the packet-tracer command.
@thediscountgeeks are both interfaces in the inside_zone? - if not the traffic won't match your ACP rules. You'll probably need a Twice NAT/NAT exemption rule between those networks to ensure the traffic is not unintentially translated. As previously suggested you can run packet-tracer to determine more information about the traffic flow.
yes, they are all in the inside zone together. I think this Firepower 1010 is fried because now the ports wont even light up after letting it boot overnight. I reset it and still nothing. This all transpired a few hours after I upgraded the software to the latest version, lesson learned. Additionally, packet tracer does not work on this unit.
@thediscountgeeks so what error do you get when you run packet-tracer from the cli?
You've enabled the interfaces in fdm?
@thediscountgeeks so if the interfaces are giving out ips, the interfaces are working?....just no lights?
Regardless you'll probably need a NAT exemption rule as previously mentioned, to ensure traffic is not unintentially franslated.
The command starts "packet-tracer", its always been available in FTD image.
This is the strange behavior im seeing, why can I ping a host on a sperate network and not the gateway that host resides on? I have also put them in the same zone.
@thediscountgeeks I assume the computer running that ping was on a different network....that won't work.
You can only ping the local FTD interface your device is connected to. You cannot ping through the FTD to one of the FTD's far interfaces, that is by design, you cannot bypass this. The only exception is if connected via VPN.
@thediscountgeeks correct, the router would behave differently and would allow the ping. You have a security device, both the FTD or ASA will not allow the ping through the device to one of it's local interfaces.
You inital issue is resolved now?