FTD Passive Interface problem (Span port)

[stephen-hardiman]

FTD 1140
interface configured as "passive",
access rule "passive" (configured per FTD configuration guide to set hardware interface passive)
Connected to SPAN port  (span port verified functional from laptop)


From the firewall perspective, it appears that no traffic is reaching the interface, logging etc is enabled. No hit counts on the access rule. 

anyone seen this ? odd that I am having issues with such a minor config... might be missing something / sw bug

[balaji.bandi]

check the guidelines  :https://www.cisco.com/c/en/us/td/docs/security/firepower/640/fdm/fptd-fdm-config-guide-640/fptd-fdm-interfaces.html

[stephen-hardiman]

Yes, i configured the firewall per the guide -  

Configure a Physical Interface in Passive Mode

What to do next

Creating a passive interface is not sufficient for populating the dashboards with information about the traffic seen on the interface. You must also do the following. The use case covers these steps. See How to Passively Monitor the Traffic on a Network.

• Create a passive security zone and add the interface to it. See Configuring Security Zones.

• Create access control rules that use the passive security zone as the source zone. Typically, you would apply intrusion policies in these rules to implement IDS (intrusion detection system) monitoring. See Configuring the Access Control Policy.

•  

[stephen-hardiman · Accepted solution]

The FTD interface i was trying to use did not release the IP assigned when it was L3  -  Remains showing as a "passive interface" in the GUI - but CLI shows the interface is not passive, still set to L3

possibly a bug.

[balaji.bandi]

glad all good, by the what version of code running on the device ?

[stephen-hardiman]

7.2.5 (Build 208)