Multi Context FTD

[simon_efi_scante]

Hi,

I must configure a new FPR 4110 and I need to configure in it a multi context.

I have read that for the moment Firepower Threat Defense doesn't support Multi Context, it's only supported with ASA.

I want to use the features of NGFW with Multi Context, how can I do that?

In the next release of FTD will be supported Multi Context?

Thank you so much

[Marvin Rhoads]

ASA image running on Cisco "Firepower" or Secure Firewall appliances does not and will not support NGFW features such as were available with Firepower service modules on the old platforms. This is the case no matter which model of hardware and will not be changing. Theoretically you could have a larger platform running multiple logical devices, one with ASA and one with FTD, and chain them together but I have never seen anyone actually do this.

[chartech0]

So theoretically, I could have an instance running FTD solely as my IPS and run another instance as ASA with all my contexts and VPN?  Would this run on an HA pair?

[chartech0]

It looks like utilizing a 3110 and FMC, I can have 2 instances where I could have a FTD running Firepower and Secure Client and have a 2nd running Asa and having my contexts linking the interfaces physically together. 

[Marvin Rhoads]

No - a 3100 series only supports Threat Defense images (FTD) in multi instance mode:

"each instance runs separate threat defense images"

Source: https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/740/management-center-device-config-74/device-ops-multi-instance.html#multi-instance-mode-vs.-appliance-mode

[Marvin Rhoads]

The case of running both ASA and FTD on a single physical chassis is only supported on a 9300 chassis with multiple security modules. It's not technically multi-instance since the security modules on that platform are technically independent computers sharing a common chassis for power and system management.

Reference: https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/740/management-center-device-config-74/device-ops-logical-devices.html#reference_vcy_dkx_22b

Support for ASA and threat defense on separate modules of the same Firepower 9300

6.4

Any

You can now deploy ASA and threat defense logical devices on the same Firepower 9300. Note   Requires FXOS 2.6.1.157.

[chartech0]

So I am back to my original question, what model of FPR will give me Firepower, anyconnect and firewall contexts?   It looks like the answer is none and there is non 1-1 solution to migrate a 5525x with 20 contexts to an FPR.  The 5525x HA was a $36k solution 8 years ago.  4110s list for $100k each and even they can only do a max of 14 instances and that is a 4145. 

[Marvin Rhoads]

Firewall contexts are being phased out as a solution due to their architectural limitations. Depending on the use case for multi-context, we can sometimes solve the same problems using multi-VRF on a single logical FTD. If it's true multi-tenancy with complete administrative separation that's needed then either multi-instance or something like spinning up separate FTDv instances on a hypervisor is needed. FMC domains can then be use to separate management among different admins.

Also, the 4100 series (4112 is the current entry level model) is a 19 Gbps NGIPS, almost 30x the performance of a 5525-X which is a 650 Mbps NGIPS. Even a small 1120 has more throughput than a 5525-X at 2.3 Gbps NGIPS. The 1200 series, when it comes out later this year (2024), will have even more performance at the entry level of the product line.

[chartech0]

The only cost effective solution I see if I stay with Cisco will be 2 HA pairs of 2110s.  One pair running FTD to give me Firepower IPS and Secure client and the other pair running ASA giving me my contexts.  I already have these separated via VRFs and each VRF has it's own context for overlapping addresses, routing and natting. 

Why do they think "contexts" limit designs?  It was asked at the beginning of this thread in 2017 if FDT was going to support "multiple contexts" and several times you said they were.  Now they feel they are a limitation.  I have been using this architecture for over 15 years of VRFs -> FW Contexts to separate multi-tenant clients.  Now that option design option is gone for me.  I never had an issue of throughput with my 5525xs  They are a great workhorse.