Zone Based Firewall - single Zones over more than one interface.

[frazreid2]

Hi, I have a question.

I build VTI's to 2 separate destinations (2 tunnel interfaces) that I would logically like to have as my outside Zone.

Added to this a standard Inside and a DMZ.

What happens to the "Sessions" noted in the firewall if a session is started outgoing over the first Tunnel but the answer comes back over the 2nd tunnel - would it pass? Or does also the interface have to be the same?

I hope that this can be understood...

Thanks for the help.

[Rob Ingram]

@frazreid2 use ECMP traffic zones.

• You can associate VTI interfaces with ECMP zones and configure ECMP static routes to achieve the following:

  • Load balancing (Active/Active VTIs)—Connection can flow over any of the parallel VTI tunnels.

  • Seamless connection migration—When a VTI tunnel becomes unreachable, the flows are seamlessly migrated to another VTI interface that is configured in the same zone.

  • Asymmetric routing—Forward traffic flow through one VTI interface and configure the reverse traffic flow through another VTI interface.

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/760/management-center-device-config-76/vpn-s2s.html

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/760/management-center-device-config-76/routing-ecmp.html

[frazreid2]

Hi Rob - not sure how to configure ECMP on a Catalyst C8300 router with VTI's.

[Rob Ingram · Accepted solution]

@frazreid2 I'm sorry I automatically assumed you were referring to VTI on FTD. I've not had this scenario before on a IOS-XE router using VTI with ZBFW to be honest. There doesn't appear to be much information in the ZBFW design guide, but perhaps you "pass" traffic instead of "inspect", you would have to amend the policy to explictly permit traffic. Else log a call with Cisco TAC and see if they have a solution.