FTD

[KayaaKashyap]

Hi,

what are the common/global/prerequisite ACLs should apply in greenfield project for DC network? where FTD is perimeter device for DC.

[Ruben Cocheno]

@KayaaKashyap 

If you are introducing a new perimeter at the DC without a rule set given, so probably i would enable permit any-any all protocols between the zones that you creating and use performance over security. And create a ruleset from the logs, and/or as requested per the client. Note: This will take a lots of time, depending on how chatty the server farm is locally (inter-zone) and to outside of the DC.

[MHM Cisco World]

The FW in DC can have role depend on direction of traffic is it from east to west or from north to south.

It can be in router  mode or transparent mode.

So we can not know excatly what ypu should allow.

MHM

[KayaaKashyap]

Traffic is north south

Firewall is in router mode

[Aref Alsouqi]

My take on this would be none : - D in the sense that before we get to the implementation and configuration stage we would have gone through all the workshops and generated an LLD for that piece of work. Deploying edge or core firewalls in a DC implies a lot of works that need to be though about in advance, because the DC will have corporate services, will most likely be connected to other sites for data replication, it would have site-to-site VPN tunnels, remote access VPN, would be connected to an MPLS circuit and so on. Same applies to a greenfield site or a brownfield site, the concept and design behind it won't change much. In addition to that, you might have the inter-VLAN routing configured on those firewalls, in that case you would also need to design ahead of time how the inter-VLAN traffic should be dealt with.

[Marvin Rhoads]

I agree with @Aref Alsouqi and @Ruben Cocheno .

Start with none and then analyze logs (firewall logs or, even better, something like Secure Network Analytics or Secure Workload). Present the high level analysis to the respective system owners and have them validate the traffic seen is what is expected and then lock down the rules to allow only observed and validated traffic.