I have a firepower 1010 managed with FDM. I have a default config with routed interfaces. Shouldnt the interfaces route between each other by default if they are in the same security zone? The only think i can think of is that I have my fiber modem in passthru mode and it assigns the WAN ip by DHCP but its a WAN gateway so it cant route my internal IPV4?
Solved! Go to Solution.
Your default ACP rule is to block. So unless the traffic is explicitly allowed in an earlier rule it will not be allowed.
You didn't share the interface-one mapping but the rules you have do not appear at first glance to cover all of the many interfaces you have configured.
You can always confirm a given flow's behavior from the cli using the packet-tracer command.
@thediscountgeeks are both interfaces in the inside_zone? - if not the traffic won't match your ACP rules. You'll probably need a Twice NAT/NAT exemption rule between those networks to ensure the traffic is not unintentially translated. As previously suggested you can run packet-tracer to determine more information about the traffic flow.
yes, they are all in the inside zone together. I think this Firepower 1010 is fried because now the ports wont even light up after letting it boot overnight. I reset it and still nothing. This all transpired a few hours after I upgraded the software to the latest version, lesson learned. Additionally, packet tracer does not work on this unit.
@thediscountgeeks so if the interfaces are giving out ips, the interfaces are working?....just no lights?
Regardless you'll probably need a NAT exemption rule as previously mentioned, to ensure traffic is not unintentially franslated.
The command starts "packet-tracer", its always been available in FTD image.
@thediscountgeeks I assume the computer running that ping was on a different network....that won't work.
You can only ping the local FTD interface your device is connected to. You cannot ping through the FTD to one of the FTD's far interfaces, that is by design, you cannot bypass this. The only exception is if connected via VPN.