Introduction
This document describes and helps to understand why NetFlow and other features will not work in a Firepower Threat Defense (FTD) in Transparent mode with inline-pair, and how to work around this.
Contributed by Christian G. Hernandez R., Cisco TAC Engineer.
Prerequisites
Requirements
Cisco recommends that you have knowledge of these topics:
Components Used
The information in this document is based on the software and hardware versions below:
- Cisco FMC v6.3.0
- Cisco FTD v6.3.0
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.
Problem: NetFlow and other features are not supported due to Partial Lina Engine check if a Transparent FTD works as inline-pair.
Once NetFlow is configured and deployed on the system through Flex Config, NetFlow does not generate flows to the collector (flow-export destination) configured.
flow-export destination Management 10.1.2.3 2055
class-map inspection_default
match default-inspection-traffic
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
no tcp-inspection
policy-map type inspect ip-options UM_STATIC_IP_OPTIONS_MAP
parameters
eool action allow
nop action allow
router-alert action allow
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect rsh
inspect sqlnet
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect icmp
inspect icmp error
inspect ip-options UM_STATIC_IP_OPTIONS_MAP
class class-default
flow-export event-type flow-create destination 10.1.2.3
flow-export event-type flow-denied destination 10.1.2.3
flow-export event-type flow-teardown destination 10.1.2.3
flow-export event-type flow-update destination 10.1.2.3
!
service-policy global_policy global
As per the table below, this behavior is confirmed to be expected on the FTD due to limited Lina Engine Checks for certain features when the system is set in inline-pair mode. See details below:
FTD interface mode
|
FTD Deployment mode
|
Description
|
Traffic can be dropped
|
Routed
|
Routed
|
Full LINA-engine and Snort-engine checks
|
Yes
|
Switched
|
Transparent
|
Full LINA-engine and Snort-engine checks
|
Yes
|
Inline Pair
|
Routed or Transparent
|
Partial LINA-engine and full Snort-engine checks
|
Yes
|
Inline Pair with Tap
|
Routed or Transparent
|
Partial LINA-engine and full Snort-engine checks
|
No
|
Passive
|
Routed or Transparent
|
Partial LINA-engine and full Snort-engine checks
|
No
|
Passive (ERSPAN)
|
Routed
|
Partial LINA-engine and full Snort-engine checks
|
No
|
https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/200924-configuring-firepower-threat-defense-int.html
NetFlow is a feature that has been confirmed as unsupported when the FTD works in inline-pair mode.
Note: The specific features not supported by the FTD, when it works in inline-pair mode, are unknown at this time, for this, the enhancement request was opened to ask the Cisco Firepower engineering team to help to confirm the known unsupported features in this mode: CSCvo55596 DOC: FMC limitation section stating what features are supported/unsupported when FTD in inline-set.
Workaround
If your setup is as specified on this document, and requires NetFlow, the only known workaround is to leave the FTD in Transparent mode and set up BVI (Bridge Virtual Interface) interfaces instead. This workaround is based on the ENH opened to include the NetFlow feature functionality for inline-pair mode deployments:
CSCvo55574 ENH: FTD unable to collect netflow data while configured in inline-pair mode.
Related Bugs
CSCvo55574 ENH: FTD unable to collect netflow data while configured in inline-pair mode.
CSCvo55585 DOC: FMC limitation section for netflow support when configured in inline-pair mode.
CSCvo55596 DOC: FMC limitation section stating what features are supported/unsupported when FTD in inline-set.