Hello everybody,
a cusctomer has a Firepower 4110 running 6.6.0 and configured by FMC.
I have a pricipal question:
Is it possible (and if yes, how) to let pass a certain UDP broadcast from one IP network to another when the FTD
has own interfaces in both?
I see in the capture a ACL drop for arriving broadcast packets for UDP port 4800:
19: 15:02:21.250475 802.1Q vlan#60 P0 172.16.17.84.56620 > 255.255.255.255.4800: udp 8
Phase: 1
Type: CAPTURE
Subtype:
Result: ALLOW
Config:
Additional Information:
MAC Access list
Phase: 2
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list
Phase: 3
Type: INPUT-ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
Found next-hop 255.255.255.255 using egress ifc identity(vrfid:0)
Phase: 4
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
Result:
input-interface: cae-domserver(vrfid:0)
input-status: up
input-line-status: up
output-interface: NP Identity Ifc
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule, Drop-location: frame 0x0000562cbd1d4720 flow (NA)/NA
But in the Connection Events log I don't see neither an ALLOW nor a BLOCK for this:
The customer has not configured an own PreFilter.
Every hint is very welcome!
Thanks a lot!
Bye
R.
