Hi,
Given the situation where GRE traffic traverses ASA and traffic is passed to the Firepower module via MPF - what does happen further with that traffic? From what I see - FP module decapsulate the GRE traffic and real addresses are used for further processing from the packet. In the ASA connection table I see the connection entries for the GRE tunnel, but within the FMC I can see the connections events for the traffic passing via that tunnel with the original IP addresses and AC rules applied to it.
Basically the question - does FP decapsulate GRE traffic passed to it automatically and is this behavior manageable?
And one bonus question - while digging this, I got the capture of asa_dataplane traffic, but when exporting it to PCAP and viewing with Wireshark it has some additional headers attached to it (for the internal communication of the ASA/FP) and Wireshark does not have decoder to handle it, so I cannot decode the inner/real headers of the traffic.
I googled around, found one script that was used for similar purpose https://github.com/SillaRizzoli/asa_dataplane_protocol/blob/master/README.TXT and a few possible advices, but none of them worked out of the box. So is there a common solution for this? Otherwise will have to wait for the inspiration to dig this deeper. :)
Cheers!
