NAT / VIP on FTD 6.1

[benatnordisk]

Hi all!

   New to FTD...

   On other firewalls I've worked on, you could set up a "virtual" IP on the firewall itself that it could then NAT to hosts behind the firewall.  I know where to set up the NAT rules using FMC, but where do we set the additional IP (or VIP-equivalent) on the specific interface?  BTW, this is a Firepower 4100 running FTD, not an ASA...

Thanks!

[christianh98114]

Hi there,

I know this question is pretty old but I wanted to see if I could give it an answer in case anyone ever stumbled on it again. Currently, to my knowledge, FTD does not support any kind of VIP object (similar to the FortiGate VIP that does the NAT for you) and any NATing will need to be done purely through the NAT section of FDM / CDO / FMC / etc.

You can think of it in terms of (very simplied, and poorly written) ASA code like the following:

nat (wan,dmz) source static Server-Public Server-Private service HTTP HTTPS

In essence, the Server-Public address from the above example would be a pseudo-VIP as your wan interface isn't necessarily assigned that IP.

For this example, you'd also want to write your ACLs to allow inbound traffic to your Server-Private subnet specifically:

access-list WAN-TO-WEBDMZ extended permit tcp any object Server-Private eq http https

Hope this helps. If I've made any mistakes, please let me know and I'll get them corrected ASAP. Thanks!