VTI on FTD

[giovanni.augusto]

Hi Everyone,

I would like to know if it is possible to create a VTI on FTD to peer with cloud infrastructure or with other FTD with a S2S VPN and BGP running on top of it.

I know this works currently on ASA code since a long time so I would be very surprised if this was not done already in FTD

Thanks!

[Marvin Rhoads]

Sorry but it's not currently possible (as of Firepower 6.4.0.4).

[giovanni.augusto]

Thank you Marvin,

Do you know what is the solution to achieve VPN connectivity with public cloud and run BGP for dynamic routing updates considering on premises FTD as the VPN termination?

[Marvin Rhoads]

You can either peer directly with the FTDv in the cloud using its dataplane interface or else use a CSRv instance.

Both options are shown here:

https://www.youtube.com/watch?v=PsicQ5RyrK8&t=288s

[giovanni.augusto]

Thank you!

Can I run BGP on top of it?

[Marvin Rhoads]

I'm not sure about your overall configuration. FTD (virtual or physical) supports BGP.

[giovanni.augusto]

Thanks Marvin,

I currently have ASAs with VTI tunnels to Google GCP exchanging routes in BGP to Google cloud router and at some point I would like to migrate to FTD.

With ASA and VTIs is pretty straightforward but still I would like to know if this is a possible scenario and what would it be my BGP local address on FTD since in Google deployment is usually the VTI ip address, and that cannot be configured on FTD

Can I ask for a suggestion on how to proceed with FTD in this case? I have been looking at FTD documentation but nothing about this.

Thanks

[Marvin Rhoads]

Do you have a Cisco account manager? It may be easiest if they can arrange a consultation with a Cisco Firepower SE or TME.

[robert.humphreys1]

Not yet tried, but Virtual Tunnel Interfaces (VTI) is now available on FTD 6.7 Cisco Firepower Release Notes, Version 6.7.0 - Features and Functionality [Cisco Firepower Management Center] - Cisco

We have been waiting for this feature to use Umbrella and some other cloud hosted services that require VTI. Though Umbrella has options for policy based we would prefer VTI with BGP.