Inner GRE Traffic is being dropped by FTD

[hadeelOth81]

Hello All, 

    We have migrated from ASA (cluster) to FTD(cluster) (on FPR4145) and after the migration a vendor lost their connectivity to their remote side that lives inside our network. They are using GRE tunnel , on the routers the tunnel status is up. But the traffic inside the tunnel is being dropped. 

By capturing traffic we noticed the traffic is being dropped by snort and the rule is the explicit (deny any any). 

We migrated the configuration from ASA to FTD and double checked that all configuration are the same. 

How on ASA it was working fine and on FTD is not?

How would we solve this problem?

Much appreciate any help!!

Thank you

[MHM Cisco World]

https://www.cisco.com/c/en/us/support/docs/security/firepower-management-center/212700-configuration-and-operation-of-ftd-prefi.html

Asa check only outer ip header ' ftd can inspect inner ip header 

Check link above how you can solve issue 

[Marvin Rhoads]

As @MHM Cisco World noted, you should account for this traffic in a prefilter policy that's attached to your Access Control Policy. Typically we Fastpath GRE traffic in the prefilter policy (if we trust it) so that the inner traffic is not inspected by Snort at all.

[hadeelOth81]

Thank you @MHM Cisco World  @Marvin Rhoads 

 Right now, we are using the default prefilter in the ACP. So I need to add 2 rules in prefilter :

 1- for the GRE tunnel source and destination

 2- To send all other traffic to SNORT --> similar to the default prefilter policy. 

Is it correct?

Much appreciate your help.

Thanks 

[MHM Cisco World · Accepted solution]

Correct 

[hadeelOth81]

@MHM Cisco World Thank you so much

[hadeelOth81]

Hello all, 

  Please I still have an issue with the GRE tunnel traffic. 

  In our situation the vendor has remote site connected to a private subnet and that subnet has a static NAT configured on the firewall to go out to the internet. 

The tunnel destination on the vendor external site is the NAT ip 

The internal remote site has the source is from the private subnet and destination is the vendor public IP address. 

In the pre-filter rule what should I have as tunnel endpoints? 

Thank you, 

 Hadeel 

[MHM Cisco World]

https://www.youtube.com/watch?v=EFdgl1dJFHY