Hi,   I have a 4100 running in transparent mode, and I got some complaints related to voice traffic. My setup is simple. I have VLAN with L2 clients and the firewall bridges to my L3 SVI interface.        Here is the document I found: https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/transparent_or_routed_firewall_mode_for_firepower_threat_defense.html#ID-2106-0000005d   Voice over IP (VoIP) and TFTP traffic, and the endpoint is at least one hop away—Add a static route on the Firepower Threat Defense device for traffic destined for the remote endpoint so that secondary connections are successful. The Firepower Threat Defense device creates a temporary "pinhole" in the access control policy to allow the secondary connection; and because the connection might use a different set of IP addresses than the primary connection, the Firepower Threat Defense device needs to perform a route lookup to install the pinhole on the correct interface.     Why do I need a static route, and where should it point to? Should I create the same static route pointing to the VLAN where my SVIs are? static interface110_l3 Voice_SrvIP Voice_SrvMask 10.0.110.1 static interface120_l3 Voice_SrvIP Voice_SrvMask 10.0.120.1 static interface130_l3 Voice_SrvIP Voice_SrvMask 10.0.130.1 Could I just do a bunch of default routes instead?  ... View more

Hi,   I understand that the ansible FTD module is only for FTD running FDM, is there a plan for FMC?    ... View more

Hello,   Just found something odd.    Custom profile for a few printers. I then added them to a logical profile. Created a policy for them.   Tested the printers, they get the profiled. They show up on the logical profile, I can see all MAC addresses.  They match the policy. Life is great!   A couple days later they don't match anymore. The policy because ISE doesn't see match the logical profile.  Other policies using logical profile are OK I re-did all the profile policies, logical profile and policy set. It works, but if there is a re-auth they will not match anymore. I also noticed that the ISE cannot get information from the logical profile.                                                  TAC does not know what is going on, but I work around by creating a policy matching on the profiled device instead of the logical profile and it works.    PS. I have other custom logical profiles and they work just fine.    Has anyone seen this before?  ... View more