Passing Layer 3 Traffic Through Transparent Mode FTDv

[Dia]

Hi All,

I am doing a new deployment of Virtual Firepower Thread Defense (FTDv) using ESXI and using ACI as bridge domain for my infrastructure.

My problem is the FTDv is running in Transparent mode between 2 routers and these routers will be running IBGP over different links one of them having the FTDv inline, BGP is not forming over this link so any Idea what could be the reason?

Regards

[Dennis Mink]

BGP requires TCP port 179 to be open between peers. check on your FW to see if this is allowed

[Dia]

I have a rule to permit any any 

[Karsten Iwen]

Are you using BGP-authentication? Then you need a workaround:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuy10017

[Dia]

Hi Karsten,

Thanks for your feedback that would help in later stage bu actually i am in the stage to establish the BGP without authentication between two BGP speaking routers peering with each other and no BGP running on FTD as it is Transparent.

Regards

[Octavian Szolga]

Hi Dia,

I would suggest you change the firewal mode to routed from transparent.

Transparent is more of a headache. You can have the same inline processing of traffic using routed mode with inline pairs, without any need for a BVI interface with IP and so on.

Afterwards, you can create your own rules to permit TCP 179 between peers plus TCP option 19 for BGP authentication.

Thanks,

Octavian

[sbhadrav@cisco.com]

In transparent mode of Firewall, you needs to create bridge groups to the vlans at both (in/out) side of firewall.

Example: Configuration on Inside/outside interfaces:

interface TenGigabitEthernet0/6

    vlan 20
    nameif inside
    bridge-group 1
    security-level 100

interface TenGigabitEthernet0/7

    vlan 30
    nameif outside
    bridge-group 1
    security-level 0

Now please configure "BVI" interface with one IP from the same IP Subnet for which you want to pass traffic through firewall:


interface BVI1

ip address 192.168.10.9 255.255.255.0 standby 192.168.10.10  (any free IP can be assigned from subnet)

Now, please allow interested traffic on ouside Interface via access-list. This will redirect traffic through transparent firewall.