Using Interface groups in an access policy?

[Chess Norris]

Hello,

I am doing a migration from a multi context ASA to a single context FTD. Both contexts in the ASA had a lot of sub interfaces and I want to make sure we don’t leak any traffic between the interfaces previously belonging to the two context.
Instead of manually add all interface zones in block rules, I wonder if I could use two interface groups and add the interfaces to those groups and then just do a block rule for traffic between those two interface groups?
I tried to add an interface group as an interface group, but when searching for that object in the ACP, I cannot find it either under Zones or Networks.

Thanks

/Chess

[balaji.bandi]

how are you doing using FDM or FMC ?

[Chess Norris]

I am using FMC and FTD 2130.

Thanks

/Chess

[balaji.bandi · Accepted solution]

Thanks for the information, then you need to do some ground work and change the design, most of the FTD are zone based.

You need to choose which path to go :

1. we did some migration with multi-instance with FTD 4K  (FTD 21XX not support here i guess)

https://community.cisco.com/t5/security-blogs/migrating-asa-multi-context-to-ftd-multi-instance/ba-p/3893465

2. if you looking to zone with single instance then you need make design accordingly, this required some testing.

[Rob Ingram]

@Chess Norris sounds like you need to use "Security Zones" - add the interfaces to the required zones and create the required ACP rules.

[Chess Norris]

The problem is that all interfaces allready belong to invidual zones (one zone per interface), so I can not create a new zone because an interface can only belong to one security zone. Thats why I thought I could use interface groups instead, but it seams like I cannot use interface groups in an access policy

Thanks

/Chess

[Marvin Rhoads]

Correct - ACP is zone-based and cannot use Interface Groups. NAT rules can use IGs.

[Chess Norris]

Thanks everyone. I got all the information I need.

/Chess