FTD · BUILD

FTD-style: one policy, two firewalls

Two branches, registered and empty, wired differently: F1 uses Gi0/0 and Gi0/1, F2 uses Gi0/2 and Gi0/3, and they name their interfaces differently. You still write one policy. Zones are why: a rule says INSIDE to OUTSIDE, and each firewall says which of its interfaces those are.

Cisco FTD-style track · Cisco FTD-style, FTD Manager · 4 objectives

Open in simulator More Cisco FTD-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

Zones INSIDE and OUTSIDE. F1: Gi0/0 named lan in INSIDE (192.168.1.1/24), Gi0/1 named wan in OUTSIDE (203.0.113.1/24), default route on wan to 203.0.113.2.
F2: Gi0/2 named users in INSIDE (192.168.2.1/24), Gi0/3 named internet in OUTSIDE (198.51.100.1/24), default route on internet to 198.51.100.2.
One network object BRANCHES (192.168.0.0/16). One policy SHARED, default block, with a rule allowing icmp from INSIDE to OUTSIDE from BRANCHES. One NAT policy with a PAT rule for BRANCHES. Assign both to both firewalls.
Compare the two previews: the same rule becomes ifc lan … ifc wan on F1, and ifc users … ifc internet on F2. Deploy to all. PCA and PCB both reach 192.0.2.1.

Start this lab

Before you start

Change the rule once, and both firewalls show Pending until you deploy again. That is the reason to have a manager.

Concept

Zones let one policy fit many firewalls

A rule names zones, not interfaces. Each firewall says which of its interfaces belong to each zone, so the same rule compiles to different lines on different firewalls. Security levels stop mattering: every interface gets level 0, and the rules decide.

Concept

Nothing changes until you deploy

A manager holds intent. Editing it changes nothing on any firewall, and a device shows Pending when the two differ. Deploy compiles the policy to configuration lines and replaces the firewall’s configuration as one change. If a line fails, the firewall goes back to what it had.