FTD · FOUNDATIONS

FTD-style: zones, a policy and your first deployment

FTD1 is registered and empty. Build its policy on the manager, and notice that nothing reaches the firewall until you deploy. The Deploy screen shows the exact firewall lines first. They are ASA-style configuration, because that is what a deployment produces.

Cisco FTD-style track · Cisco FTD-style, FTD Manager · 5 objectives

Open in simulator More Cisco FTD-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

Zones INSIDE and OUTSIDE. On FTD1: Gi0/0 named inside in zone INSIDE (192.168.1.1/24), Gi0/1 named outside in zone OUTSIDE (203.0.113.1/24).
A default route on outside to 203.0.113.2.
Network object LAN (192.168.1.0/24). Access control policy ACP1, default block, with rule INSIDE-OUT: allow icmp from INSIDE to OUTSIDE. NAT policy NAT1 with a PAT rule HIDE-LAN for LAN from INSIDE to OUTSIDE. Assign both to FTD1.
Read the preview, then deploy. FTD1’s show running-config now has the lines you read.
PC1 reaches 198.51.100.1.

Start this lab

Before you start

Before you deploy, try the ping: it fails, because the policy is still only on the manager. FTD1 has no security levels to rely on: every interface gets level 0, and the rules decide. The lines called CSM_FW_ACL_ are your rules: each names the interfaces it covers, worked out from the zones.

Concept

Nothing changes until you deploy

A manager holds intent. Editing it changes nothing on any firewall, and a device shows Pending when the two differ. Deploy compiles the policy to configuration lines and replaces the firewall’s configuration as one change. If a line fails, the firewall goes back to what it had.

Concept

Zones let one policy fit many firewalls

A rule names zones, not interfaces. Each firewall says which of its interfaces belong to each zone, so the same rule compiles to different lines on different firewalls. Security levels stop mattering: every interface gets level 0, and the rules decide.

Concept

Firewall NAT: three sections, applied in order

An ASA checks NAT rules in three sections. Manual (twice) rules come first, in the order you write them. Object (auto) rules come next, static before dynamic and the most specific first. Manual rules marked after-auto come last. Static NAT publishes a server, and the firewall answers ARP for the public address. Access rules name real addresses, because untranslation comes first.