flexconfig in Cisco FTD

[shaikh.zaid22]

Hi

We have a cisco ftd configure via fmc.

We have a guest ADSL connection configured via Flexconfig PBR to route the guest subnet 10.10.251.0/24 to ADSL GW.

Now i have a requirement to exclude 2 ip addresses from the 251 range from the flexconfig PBR.

Need assistance how i can achieve it.

[balaji.bandi]

check this guide :  ( remove related config related to IP subnet you looking to remove) so it used default route

https://integratingit.wordpress.com/2021/04/18/ftd-policy-based-routing/

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/217588-configure-pbr-with-ip-slas-for-dual-isp.html

[Marius Gunnerud]

I am assuming you have an ACL that is matching on the traffic that is to be sent to the guest subnet?  If so, then it is just a matter of adding deny statement at the top of that ACL for the two IPs you want to exclude and then deploy.

[shaikh.zaid22]

Hi Marius,

You are correct, i have one subnet in one ACL that is called-in to the Flexconfig.

From this same subnet i want to remove/axe two ip addresses to not get forwarded towards the ADSL GW.

So shall just add the two ip's in the same ACL with Actions as Block ?

[Marius Gunnerud]

Correct, just add the two IP in the same ACL with block action, above the permit rule (this is important), and you should be good.

[shaikh.zaid22]

Thanks Marius. I will do as directed.

However, do i not have to touch anything in the flexconfig part ?

Only ACL changes will suffice right ?

Thanks once again

[Marius Gunnerud · Accepted solution]

Just the ACL configuration.

[shaikh.zaid22]

Thank Marius. 

It worked.

[Marvin Rhoads]

For PBR, the Flexconfig policy references the ACL. so changing the ACL suffices to change the net behavior of the Flexconfig policy