FTD 1010 default action behavior with base license

[tato386]

I have an FTD 1010 with only a base license and a requirement to use this as a simple Internet router/gateway.  I have a dynamic NAT rule using interface PAT and one access rule that trusts outgoing traffic.  If I set the default action to block I cannot get Internet traffic to flow so for now I have the default action to trust to get things going.

At the moment this is not a big deal but what would happen when/if I setup a static NAT?  At that time I would want to set the default action to block to prevent unwanted traffic to the static NAT host but then it would break the dynamic NAT clients?

 

[Rob Ingram · Accepted solution]

@tato386 if traffic is not matching your defined access control rule, are your physical or vlan interfaces actually assigned to the correct zones (inside_zone and outside_zone)? You do not need to define a rule using the zones, you could just use the source/destination networks.

[balaji.bandi]

i do not believe this due to your License, more of config issue looks for me. not able read the image properly to suggest something here.

[tato386]

@balaji.bandi is correct it does not have anything to do with the license.  It was an issue with the configuration of the security zones.  The zones were one of the first things I setup and I am 99% sure I added interfaces at that time but lo and behold when I double-checked (thanks @Rob Ingram !) the zones were empty?!  After adding (re-adding?) the interfaces traffic flowed correctly with block as default action.     An interesting thing is that Internet traffic seems to be working perfectly normal but curiously, inbound reply from DNS servers is showing as being blocked.  Should I worry about this if things appear to be normal?

[Marius Gunnerud]

Do you only have the inside_zone or are there more subnets behind the FTD?

Currently, if you add a static NAT statement and an access rule allowing access to that server from the outside, and then set the default action to block, users on the inside_zone will still be able to reach the internet.