FTD · VPN

FTD-style: a site-to-site tunnel from the manager

Both firewalls work and are on the same manager, and the provider R1 knows nothing about either LAN. On an ASA you would build each end by hand, and any small difference breaks the tunnel. Here, one form describes both ends, and each firewall gets its own lines.

Cisco FTD-style track · Cisco FTD-style, FTD Manager, Cisco router · 4 objectives

Open in simulator More Cisco FTD-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

Network objects SITE-A (192.168.1.0/24) and SITE-B (192.168.2.0/24).
On the VPN screen, add tunnel A-B: IKEv2, key LABKEY, from F1 with SITE-A on outside, to F2 with SITE-B on outside.
Read both previews: the same tunnel, mirrored, with each firewall naming the other as its peer. Deploy to all.
PCA reaches PCB. The VPN screen shows the tunnel Up, with packets both ways, and F1’s show crypto ikev2 sa agrees.

Start this lab

Before you start

A tunnel comes up when traffic arrives, so it shows Not used yet until you ping. The access policy still decides what may leave the inside: this one allows icmp from INSIDE to OUTSIDE. Remote access VPN is not modeled on FTD yet.

Concept

Site-to-site IPsec VPN

Two firewalls join their LANs across the internet. Interesting traffic, which the crypto ACL names, is encrypted and sent to the peer. First the firewalls agree in IKE phase 1 (a policy both have, and the same pre-shared key), then in phase 2 (a transform set or proposal both have, and crypto ACLs that mirror each other). NAT comes before encryption, so the VPN traffic needs a NAT exemption.

Concept

Nothing changes until you deploy

A manager holds intent. Editing it changes nothing on any firewall, and a device shows Pending when the two differ. Deploy compiles the policy to configuration lines and replaces the firewall’s configuration as one change. If a line fails, the firewall goes back to what it had.