cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
174
Views
0
Helpful
1
Replies

Number of ACL on FTD security zone with multiple interfaces

a12288
Participant
Participant

We have a DMZ security zone on FTD and it has multiple VLANs / sub-interfaces, I found out every ACP created actually are duplicated to all VLANs / sub-interfaces, for example, my intention is:
Source -> DMZ -> VLAN-A/Sub-Interface-A -> App-A
Source -> DMZ -> VLAN-B/Sub-Interface-B -> App-B
Source -> DMZ -> VLAN-C/Sub-Interface-C -> App-C

But the show access-list CLI reveals it actually like this
Source -> DMZ -> VLAN-A/Sub-Interface-A + VLAN-B/Sub-Interface-B + VLAN-C/Sub-Interface-C ->  App-A
Source -> DMZ -> VLAN-A/Sub-Interface-A + VLAN-B/Sub-Interface-B + VLAN-C/Sub-Interface-C -> App-B
Source -> DMZ -> VLAN-A/Sub-Interface-A + VLAN-B/Sub-Interface-B + VLAN-C/Sub-Interface-C -> App-C

As a result of this multiplication, the number of ACL is quite large. Is this the expected behavior or something I can adjust to avoid this? Thanks.

 

Leo

 

1 Accepted Solution

Accepted Solutions

manabans
Cisco Employee
Cisco Employee

A Security Zone is used to create the rules for the Access Control Policy, so this behavior is expected. Regardless of which interfaces are included in the security zone, the ACL will be expanded accordingly.

In order to prevent unwanted ACL expansion, you should create separate security zones for each interface and reference them in an ACL rule.

View solution in original post

1 Reply 1

manabans
Cisco Employee
Cisco Employee

A Security Zone is used to create the rules for the Access Control Policy, so this behavior is expected. Regardless of which interfaces are included in the security zone, the ACL will be expanded accordingly.

In order to prevent unwanted ACL expansion, you should create separate security zones for each interface and reference them in an ACL rule.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers