Using an FTD 5515-X in both a Routed Mode and Transparent mode at Same Time

[Lucas Phelps]

I've got a Cisco 5515-X running the latest 6.2.3.2 FTD code.  I'd like to use 4 interfaces for Routed mode traffic to replace an aging ASA 5510 with the old code (DMZ, Inside, Outside, and Failover Interfaces).

I'd like to use the other remaining interfaces on the 5515-X FTD to do a simple bridged/transparent interface pair (in layer 2 mode) to just inspect internal traffic without any routing between different subnets.  I'd also like the ability to block traffic here, so I'm not sure a 'Passive' interface would work.  

Is it possible to accomplish this in any way on the same device?

Thanks in advance!

[Lucas Phelps · Accepted solution]

I figured this out.  First of all, I configured the FTD appliance in 'Routed' mode rather than 'Transparent'.

Then I configured the first three interfaces:  1) Inside  2) Outside  3) DMZ

Then I created an Inline Set with interfaces 4 and 5.  An Inline Set is simply a layer 2 bump-in-the-wire with no ip addressing needed.  It simply passes traffic from one interface to the other and inspects on the fly.  The Inline Set doesn't do any kind of routing at all - It's simply a monitoring point for another flow of traffic on my network separate from the 3 interfaces above (Inside, Outside, DMZ).

When the interfaces are put into an Inline Set, it changes the mode on the interface from 'Routed' to 'Inline' to indicate the change.

[Marvin Rhoads]

I thought that you could do as you figured out; but I wasn't certain and didn't have a spare unit handy to confirm it.

Thanks for sharing your results!

[Terry Grant]

Lucas,

  I'm looking into this same use case, but using FTD 4110 hardware.  Does the inline set use the same access control policy as the routed interfaces?  How has it been working since your implementation?

Thanks,

Terry