Is FTD’s control plane wide open?

[guacamoley]

I was looking into setting up BGP on an ftd and was wondering where to allow TCP179 and then I realized there is nowhere to even add this as an access entry. Same goes for VPN. Is this not wildly insecure?

[MHM Cisco World · Accepted solution]

https://integratingit.wordpress.com/2021/06/26/ftd-control-plane-acl/

In FTD using control -plane done via flexconfig 

Check link' I alos will check new versions of fdm and fmc if there is option to add it directly.

Thanks 

MHM

[Rob Ingram]

@guacamoley you can use the control-plane ACL functionality to restrict access "to" the FTD such as BGP, currently you must use FlexConfig to configure this.

https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-threat-defense/221531-configure-control-plane-access-control-p.html

[tvotna]

As @Rob Ingram and @MHM Cisco World mentioned, you can use "access-group <name> in int outside control-plane" to control who can access TCP/179. Obviously, it is practically impossible to do the same for TCP/443, although technically control-plane ACLs do work for TCP/443 too. This means that TCP/443 is wide open and the firewall doesn't have protection for TCP/443.

Also, if you, for example, try to rate-limit TCP/443 messages to protect device from DoS, you'd find that none of ASA features work:

- "class-map type management" doesn't allow you to limit connections or embryonic connections per-host in the corresponding policy-map
- "class" and "member" constructs do not limit to-the-box connections in case of multiple context mode (on ASA), hence "limit-resource rate" doesn't work too (this tool is unavailable on FTD as it doesn't support multiple mode)
- MPF is not capable of connection rate-limiting at all.

HTH

[guacamoley]

Doesn't the FTD have its own DDOS protection with the Network Analysis Policy? 

[Rob Ingram]

@guacamoley the NAP is for traffic "through" the FTD not "to".