Firepwer 7000 and GRE traffic decapsulation

[Mohammed Ashraf Ali]

Hi,

We have Cisco Firepower 7000 series boxes running 6.2.3 installed in transparent mode in our customer network managed by FMC.

The customer has some Gre tunnel traffic passing through PF , which is being decapsulated/decrypted.

The customer has requested us to stop decapsulation/decryption of Gre in FP , and allow the traffic to by pass inspection.

As per i know there is no way to add pre-filters for FP 7000 series. so what is the alternative to achieve the same.

Regards,

[Abheesh Kumar]

Hi,
Try creating a trust rule with source/destination (inner header) for the GRE tunneled traffic.

Hope This Helps
Abheesh

[Mohammed Ashraf Ali]

Hi,

Thanks for reply,

But The requirement is to stop decryption of GRE traffic, rather than bypassing inspection of GRE inner header traffic.

regards,

[Ilkin]

Classic Firepower devices use outer headers of GRE encapsulated packets for policy matching. In customer`s is the policy matches based on the inner addresses?