How FTD manages UDP traffic

[Robturner1]

Morning

We have started to implement FMC and FTD in our estate and have found that the TCP was working fine over the tunnels that we have created.  However, UDP did not seem to be working.  This caused issues around DHCP and voice.  Can anyone guide me to how to get the FTD to inspect the UDP traffic in a stateful manor rather than it blocking or discarding it?

Thanks

[patoberli]

Let's start with the basics, UDP is a stateless protocol.
Ok, now that we have established this part, you probably realize the problem.
DHCP is even worse, as it uses Broadcast, which normally doesn't work through VPN.

There are some Inspect rules that you can enable/disable, for example for SIP voice traffic, more details here: https://www.cisco.com/c/en/us/td/docs/security/firepower/623/fdm/fptd-fdm-config-guide-623/fptd-fdm-advanced.html

Most often you should (must) simply open the needed ports between the source/destination though.