Firepower Threat Defense - brdige or inline?

[Claudio_Lodigiani]

Hi everyone
I need to inspect traffic flowing on a L2 segment of my network
I’m using a FTD 1010 with 6.5 software
I’m wondering if it’s best to use a bridge group or an inline set
I didn’t find any clear statement from Cisco about choosing between bridge or inline
Regards
Claudio

[Rob Ingram]

Hi @Claudio_Lodigiani 

Sounds like you want to use transparent mode. Read this reference for more information.

https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/transparent_or_routed_firewall_mode_for_firepower_threat_defense.html#ID-2106-00000012

This  doc states - "Layer 2 connectivity is achieved by using a "bridge group" where you group together the inside and outside interfaces for a network,"

This guide provides information to create an inline set.

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/200924-configuring-firepower-threat-defense-int.html

HTH

[Claudio_Lodigiani]

Hi @Rob Ingram 

Thank you for the reply.

I’ve been studying the documentation since last month.
Now I re-read carefully the configuration guide and I got the point.
If I’m not wrong, in-line sets are IPS passive online interfaces and can not do some typical firewall checks and functionality
Bridge groups (available also in routed mode since 6.2) on the other end can be used to inspect L2 traffic and retain firewall checks

Am I right?

Claudio

[Marius Gunnerud]

An inline set can either be passive (inline set with tap) as you say or it can also drop (inline set) depending on how you implement it.  With inline pair with tap only a copy of the traffic is sent to the FTD, while in inline set all traffic passes through the FTD and traffic can be dropped.

Bridge groups are used for firewalls in transparent mode and do not have anything to do with IPS.  You can configure bridge groups as well as have inline set configured at the same time.

[Marius Gunnerud]

The bridge group is used in Transparent mode to group 2 or more interfaces together and allow traffic to pass between those interfaces.

The inline set can be used in both routed and transparent mode, and defines ingress and egress interfaces that are to be used for IPS inspection.

[Claudio_Lodigiani]

Hi Marius thank you for the reply

Bridge group can be used also in transparent mode since ver 6.2

My practical question is: should I use a bridge group or an inline set to inspect and secure traffic? I have a scenario where I'm forced to install the firewall without affecting Layer 2 topology (no Layer 3 firewall)

Bye

Claudio

[Marius Gunnerud]

Are you talking about the integrated routing and bridging feature that was added in 6.2?

[Claudio_Lodigiani]

yes, exactly 

[Marius Gunnerud · Accepted solution]

My practical question is: should I use a bridge group or an inline set to inspect and secure traffic? I have a scenario where I'm forced to install the firewall without affecting Layer 2 topology (no Layer 3 firewall)

In this scenario you would want to install the firewall in transparent mode, which would use "bridge groups" as you have mentioned.  In transparent mode you will still be able to perform both LINA (ASA access lists, etc.) and Snort (IPS) functions.