Multi Context FTD

[simon_efi_scante]

Hi,

I must configure a new FPR 4110 and I need to configure in it a multi context.

I have read that for the moment Firepower Threat Defense doesn't support Multi Context, it's only supported with ASA.

I want to use the features of NGFW with Multi Context, how can I do that?

In the next release of FTD will be supported Multi Context?

Thank you so much

[Aditya Ganjoo]

Hi,

Until now we do not have any information on this.

If you install ASA on FPR only it can be used in the multiple context but not FTD.

Regards,

Aditya

Please rate helpful and mark correct answers

[Marvin Rhoads · Accepted solution]

FTD support for multiple context is planned for a future release but the release is not yet confirmed. I wouldn't expect it this year (2017).

There are alternatives such as security zones that may address the use case that led you to want multiple contexts. If you can share the functional requirements we may be able to suggest a way to satisfy them.

[#Mat]

Hi Marvin!, how can we deploy the workaround with security zones?

Thanks!

[Marvin Rhoads]

If multiple contexts are only to separate tenants' or departments' traffic administratively and security-wise you can simply define them as separate zones and keep their traffic separate by not allowing traffic between the zones.

Only if you need features like support for independent distinct routing tables (potentially with overlapping address space) and delegated management without the ability to see other tenants would you need multiple contexts. In such a case, Cisco advocates putting traditional multiple context ASA "in series" with Firepower appliances to get all the features of both products.

Personally I believe this is a bit more complexity and cost than should be necessary to meet the functional requirements but it will work.

[jaime.pedraza]

Hi Marvin, 

¿Have you heard any update about the multi context feature on Firepowers? 

Thanks!

James

[Marvin Rhoads]

There's been no update from Cisco.

I know they are aware that it is an in-demand feature from many customers but they have not yet made any public commitment to deliver it.

If it's important to your organization or your customers then I strongly suggest you make sure your Cisco account manager knows that. The more customers asking for it, the better the business case inside Cisco for making it a higher priority.

[eniola@ipconstruct.co.uk]

Is there any guidance on separating multiple tenants into security zones on the ASA  as you suggested . I thought the Zone based deployment model only applied to router based firewalls.

[bernardovr]

Hi Marvin,

Is this possible now? or we must wait.

Thanks

[Marvin Rhoads]

There's no update since I last posted 72 hours ago.

The feature is not available in Firepower 6.2.2.

Watch the release notes as new versions come out - that will be the definitive source for this information.

https://www.cisco.com/c/en/us/support/security/defense-center/products-release-notes-list.html

[robert.humphreys1]

https://www.cisco.com/c/en/us/td/docs/security/firepower/630/relnotes/firepower-release-notes-630.html

Hello,

Cisco have just released Firepower 6.3.0 as of Wednesday, 5th December. Multi-instance is now available.

[chartech0]

It is now 2024.  Does FTD yet support multiple contexts yet?   It seems multiple instances complicate the process.  I have heard finally in release 7.2.0+ finally supports Anyconnect.  ASA does not support Firepower on 2110 platform only FTD.  I need a solution to support anyconnect, multiple contexts and firepower.  Does this exist yet?

[Marvin Rhoads]

FTD does not now nor will it ever support contexts. Multi-instance with FTD is the way to support similar features.

Remote access VPN with AnyConnect (or Secure Client as it is now known) has been supported on FTD for years now - well before version 7.2.x.

[chartech0]

Is there another model above the 2110 that in ASA mode would support multiple contexts, firepower and anyconnect.  The only reason I am upgrading/replacing my 5525x  multitenant solution is because Cisco has EOL it pretty much without a 1-1 solution.  I will have to move up to a 4110 to get 20+ Multi-instances.