Agent-to-Agent test behind firewall

[atsukane]

Hi All,

We are running Agent-to-Agent tests between offices and DC, and seeing loss on the pass visualisation where next hop is firewall.  Firewall is FMC managed Cisco FTD running 7.4.2.1-30.

I'm allowing tcp49153 that is required for agent-to-agent communication and also ICMP on the firewalls at the both ends.

For instance, the below are tests between UK and Singapore, and 100% forwarding loss at the switch in front of the firewall.

Allowed traceroute on the firewall following the below doc, but in our case instead of using the inside and outside interface, using the inside and thousandagent vlan interface, plus platform settings is have rate limit and burst size both set to 3, this was done during the POV.

Allow Traceroute through Firepower Threat Defense (FTD) - Cisco

However, this has not resolved the issue and still seeing loss.

Any idea how to get around this? 

We could use Agent-to-Server test instead between offices alternatively which seem to work and not seeing any loss, but Agent-to-Agent test seems ideal.

Many thanks,

[Tyler Langston · Accepted solution]

Hi @atsukane - great to hear from you!

This is one of those tricky 'middle of the road' kind of community questions: there are definitely some resources to provide but I don't have a specific answer. Our experts were torn between providing general info and asking you to contact support so they could get direct eyes on it. So we're going with a 'middle of the road' kind of answer and provide both.

From our experts:

The three most useful docs for this type of scenario are:

General overview of how the test works
Deep dive of how the test works
Firewall requirements

If these aren't helpful in resolving the issue, please contact Support so they can review in more detail and help get you specific details.

[atsukane]

Thank you @Tyler Langston .

We have 5 days worth of PS time from Cisco, so we can work with them to resolve the issue. 

Just wondered if there are people in this community faced similar issue

Thanks again.

[Tyler Langston]

Thanks @atsukane - if you still need some help after working with PS shoot me a private message!