We have an FPR 2110 (running version 7.0.1) managed by an FMC 1600, configured as:
Transparent mode; Inline set for the inside and outside port. The GRE tunnel terminates on two L3 cisco switches, so we are not trying to terminate a GRE tunnel from a FTD device (we know you can't do this). We choose the transparent inline because it allowed for an easier connection without adding additonal networks or network addressing rework.
The FTD is on our edge. This is a private company network isolated from the internet (by design). We use EIGRP routing over GRE tunnels. Our zero clients in our LAN cannot connect with the remote horizon server. When we fastpath the GRE tunnel traffic, everything works. However, this defeats the purpose of an edge IPS device. Also, our FTD is using snort3. We tried snort2 without any luck. We believe there is one or more snort inspectors dropping the packets or altering them. We wiresharked the connection between the zero client and the connection server (horizon). The TCP handshake works just fine, but we notice that something happens that prevents the conversation from going to TLS. The TCP connection conversation starts over and the process repeats with no connection. If we move the FTD out of the tunnel and connect a zero client directly to the FTD, the zero client connects with no problem. So our testing points at snort. We think a snort inspector is involved somehow. Any best practice or ideas, when using an FTD inside GRE tunnel as an edge IPS device?
