FTD with Inline-Set

[fatalXerror]

Hi guys,

I have 2 units of FTD that will be in transparent mode and I plan to configure it with inline-sets for the IPS and I plan to set it up in active-standby FTD.

My question are:

1. Will there still be a stateful failover in transparent FTD with inline-set interfaces? 

2. Can I form an OSPF neighbor with my router if my FTD in transparent mode with Inline-Set interfaces is in between the routers?

Thanks

[tvotna]

Transparent mode and inline-set interfaces are different animals. You don't need inline-set interfaces if you want to pass OSPF through. Use transparent mode and regular interfaces instead. I believe that stateful HA doesn't replicate connections created on inline-set interfaces, because those connections are tcp-state-bypass connections from Lina point of view. But upon failover Snort should be able to pickup flows midstream and traffic should not be interrupted. This document explains inline-set interfaces very well:

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/200924-configuring-firepower-threat-defense-int.html