Firepower FTD 2110 /31 IP

[Luke Fahey]

Hi There,

We have just purchased a 2110 and were in the process of setting it up and have hit an early road block. Our ISP is using a /31 subnet for our internet link and it seems FMC will not support this when configuring the interface.

Is there any work arounds for this or do we need to go back to our ISP and change to a /30 IP range. We would rather not have to do this as we use this IP for many cloud services etc.

Looking forward to some advice.

Thanks

[Marvin Rhoads · Accepted solution]

/31 addresses are not currently supported on FTD. Another customer reported the same thing a couple of months back and Cisco TAC confirmed the support was not currently there on 6.2.3:

https://community.cisco.com/t5/firewalls/ftd-6-2-3-on-asa5506-x-unable-to-use-31-mask-on-ipv4-data/td-p/3866229

It wasn't changed in 6.3 or 6.4.

I don't have any word as to whether this will change with any upcoming releases.

[Luke Fahey]

Thanks @Marvin Rhoads Appreciate that. Will need to get the ISP to change the IP to a /30.

[Abraham012]

Hey Marwin,

Based up on below cisco document, its supported in 7.1 version:

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/710/management-center-device-config-71/interfaces-settings-ifcs-firewall.html#id_39144

[Abraham012]

Hey Folks,

I tried in my lab by installing 7.1 version. Yes am able to assign the /31 IP to the interface, but with warning as attached.

[Aref Alsouqi]

I think that warning message is just to tell you that if you are configuring a /31 on an interface where the broadcast and the network ID are required it will cause problems. The /31 should only be used on a point to point connection where no need to any other IP address but the host IPs.