You need to use flexconfig for PBR and use a rest API for update your PBR access-list. My sugestion is use Minemeld ( from palo alto ) for easy IP list filter.   Best regards Pablo Costa ... View more

Oi, Acredito que sim já que FDM suporta vpn site-to-site ipsec por padrão. Você vai ter que criar todas as regras de nats mas com alguns testes acredito que possa conseguir. Sugiro utilizar FMC para fazer essa configuração. Você terá mais flexibilidade nas configurações. Translation I Belive you can do it with FDM because FDM suports site-to-site VPN by default. You will need to create all NAT by hand but will be not a problem. Imo u should be use FMC for administration. You will have more flexibility and more options to configure. Best Regards Pablo Costa ... View more

Hi, We have around 10 implementations with FTD. I can tell you will give you  a little pain in the head because there is some features that you need to work hard to delivery everything like customers want. SSL/TLS decryption is the most trick feature imo. There is no many options to make a exception ( you can not add a external feed list to exclude. ex: office 365 ). You only can use URL categories and others SSL/TLS options to do this and, imo, is not the best way to to this. FMC 6.2.2.1 is too slow if you comper if others vendor. But is much better now. I like ASA a lot, working with Firepower about a 2 years need much improve to beat firewalls solutions like paloalto and fortnet. ( its sad but its true ) Btw all implementations was sucessfull. If you need some help we can help you. Best regards Pablo Costa ... View more

1 question : will send a RST flag for reset the connection ( this is for timeout connection ) you can see this working with "show conn | include X.X.X.X" command. 2 question : will respect the access-list that you created. Only for the matched traffic. Best regards Pablo Costa ... View more

Configuration --> Service policy Rules --> Add and follow the wizard ( see the picture attached please ) ... View more

You can create an access-list to match traffic then a class-map and set a a connection timeout specific for the class-map examples access-list teste permit tcp host X.X.X.X  class-map test match access-list teste exit policy-map global_policy class test set connection timeout tcp 1:0:0 reset ( something like this .. not testing this commands ;) ) ... View more

Samantha you can perform a "sh running-config all" and filtering for timeouts you will see all values. Best regards Pablo Costa Netconsulting BR ... View more

hi, I recive 3 3750G last week and I had the same question, well this is what I know about. "Stack member number identifies each member in the switch stack" You can know about perform "show switch". All "new" switches came with defaul stack member 1. From docs "When it joins a swtich stack, its default member number changes to the lowest avaliable member number in the stack" If you want to change stack member number just perform: switch renumber regards ... View more