I'm looking at replacing the FP7030 with the FP2110 or higher. I was intrigued with the options to have a firewall and IPS on one box using the FTD Image. After scanning the documents for configuration setup. We will use the FTD firewall mode, but it looks as if we can't use the IPS function. Is it accurate to say that even though both modes are supported in the same appliance that we will only be able to use the Firewall mode but cant use the IPS function on that same network? I want to use this to do inter-vlan routing at the firewall and then send data to router if needed to WAN, but that requires the firewall to have physical sub interfaces, but then we wont be able to use the IPS because that is a network tap and traffic is then forwarded to one interface to the next without routing. I thought the FTD was a combination of services that could be utilized. Are there some valid solutions to apply a security policy to the firewall interfaces?
Solved! Go to Solution.
Thanks for the response.
We have to equip an IDS to our network.
The FTD states to be a combination of IPS/Firewall. But you can only create an interface as a firewall (routed) or IPS (bridged) If we route (firewall) then I can apply sub interfaces, VPN, and more. But I lose the IPS function for those sub interface networks. If I use the IPS (bridge) on the interfaces then I have to forward traffic to my router (WAN) and build the trunk there. I wanted to have traffic enter the WAN and then hit firewall, per our policy we must have the WAN routing facing our PE. The firewall could be utilized for inter vlan routing, and also negate me from using the ZBFW on the WAN.
The FP2110 comes with 12 1GE interfaces.
I just thought of an idea about using the IPS function from Router to FP, then plug a cable from that interface on the FP into another interface on the same FP that is then a firewall interface.
I have a FMC1000K9 managing all my devices.
There are two modes Firewall and FTD.
I'm using the FTD IOS version.
I thought that if I have the interface on the device also in routed mode for Firewall then I could not apply IPS policies to that same interface. IPS in the documentation was a L2 function, routed L3, and then also the documentation reads as if the IPS mode could only operate in bridge mode, and you cant put interfaces in both bridge and routed. But you are telling me that I can have a firewall interface managed in FMC and still apply a security policy that performs IPS functions to it. That seems then that the Device would be applying firewall policies and IPS policies. That would be great.