FTD with Anyconnect

[Maurice Ball]

I have a customer who is using Cisco Anyconnect for user remote VPN network access on an FTD appliance. The FTD appliance is the secondary firewall on the edge of the network and is connecting to their primary firewall. They would like to route all Anyconnect VPN traffic including Internet traffic through the primary firewall which is connected on the inside interface of the FTD appliance.

Is it a way I can point the default route to the primary firewall that is on the inside interface but still allow remote VPN access on the outside interface of the FTD appliance?

[Rob Ingram]

@Maurice Ball if using an FMC to manage the FTD you can select the "tunneled" option, which will define a separate default route for VPN tunneled traffic, routing the traffic to the specified next hop - which maybe different to the default route.

https://www.cisco.com/c/en/us/td/docs/security/firepower/601/configuration/guide/fpmc-config-guide-v601/fpmc-config-guide-v60_chapter_01100100.pdf

However this option does not exist as of version 7.1 when managing the FTD local using FDM.

[Maurice Ball]

Sorry, but I am not understanding how to make this work based on the article. The VPN user's internal traffic and Internet traffic are both considered to be data traffic.This article states that you are able to create  two default routes one for data and one for management traffic. I do not understand how I can use that configuration in this deployment. Could you please provide more details on how that would work?

[Karsten Iwen · Accepted solution]

Look for Step 10 on page 4 of the document provided by @Rob Ingram.

Another option is to place the Firepower with only one interface in a DMZ of the primary Firewall. Traffic flow would be the following:

1. AnyConnect traffic reaches outside Int of primary firewall
2. A port-forwarding for TCP/443 and UDP/443 sends the traffic to the FTD
3. FTP processes the AnyConnect traffic and sends it back through the default-route to the primary firewall
4. The primary firewall can act on the traffic as needed.

[Maurice Ball · Accepted solution]

Ok, great. Thanks for the help