FTD Site To Site VPN

Firewalls running Threat Defence support site to site (AKA LAN-to-LAN) VPNs.
They’re slightly
different though, as the VPN is configured in FMC, not on the device itself.
In this article, we’ll look at how to configure a site-to-site VPN through FMC.
Please note, this applies to FMC managing devices that run FTD. Regular ASA with Firepower
Services do not have their VPN’s configured in FMC.
It is recommended to have an understanding of IPSec, especially phase-1 and phase-2, before
starting
Topologies
The first thing to be aware of is the topologies that are supported. There are three topology types to
choose from:
• Point to Point– This is a simple topology between two endpoints. In FMC, A and B nodes
need to be defined
• Hub and Spoke– A group of spoke sites creating tunnels to a hub site
• Full Mesh– A group of multipoint tunnels, where any device can connect to any other
Each device in any of these topologies is called an endpoint. At least one endpoint will be a device
managed in FMC.
Any device in your VPN topology that’s not FMC managed is called an Extranet device. This
includes devices in your network that don’t run threat defence, devices outside of your network
(such as a router in a partner network), and Threat Defence devices managed by a different FMC
server.
We can use FMC to push VPN config to remove FTD devices. This is possible for devices managed
in our FMC, or devices managed with another FMC server (such as a remote office managed by a
different team).
Each endpoint has a protected network associated with it. This is, as the name suggests, the
network that’s behind the VPN device. The ultimate goal of the VPN is for the protected networks
to communicate with each other.
No special licensing is required for the VPN, as long as export-controlled features is enabled.
Configuration
IKE Policies and IPSec Proposals
Each endpoint can be authenticated using either certificates or preshared keys. Preshared keys may
be automatic if FMC manages all the endpoints.
There are some predefined IKE policies that you can use, or you can create your own:
1. Go to the Objects tab
2. Browse to VPN, then either IKEv1 or IKEv2
As shown below, you can select the algorithms that you want to use. The same applies to IPSec
proposals.
Topology
We’ll now create a point-to-point VPN that connects to a third-party device.
1. Browse to Devices ->VPN->Site To Site
2. ClickAdd VPN->Firepower Threat Defence Device
3. Enter a name for the topology
4. Select a topology type (point to point in our case)
5. Select the version of IKE to use (IKEv2 is recommended)
Now we need to define our first endpoint (Node A).
1. Make sure you’re on the Endpoints tab
2. Next to Node A, click the green Add button
3. Select a Threat Defence device that your FMC manages from the list
4. Select an interface that the VPN will be established on
5. If there is more than one IP address on this interface, select the one to use
6. If this is a private IP address (non-routable over the internet), tick the This IP is Private
checkbox, and enter the corresponding public IP
7. Select the Connection Type
• Bidirectional– Either node can negotiate the VPN
• Answer-Only– The local node will respond when the remote node negotiates the
VPN
• Originate-Only– The local node will negotiate the VPN, but will not respond if the
remote tries to negotiate
8. Click the green Add button next to Protected Networks
• Add one or more networks behind this device, that will be accessible over the VPN
• From FMC 6.2.3, you have the option of using a subnet/IP address object, or an
extended access list
Now, configure the remote endpoint (not managed by us):
1. Next to Node B, click the green Add button
2. Select Extranet as the device
3. Enter a friendly Device Name
4. Enter the IP address of the device
5. For version 6.2.3 and newer, there will be an option to add a certificate map (we don’t need
it, as we’re using preshared keys)
6. As before, add a protected network
Next, we configure IKE (the phase-1 tunnel). The settings available to us are determined by the
version of IKE that we’re using.
1. Go to the IKE tab
2. Select a suitable policy (we’re using the predefined AES-SHA-SHA policy)
3. Select the authentication type
• A preshared manual key is entered at both ends manually
• A preshared automatic key is managed by FMC. This requires FMC to manage both
ends
• A certificate can be used, but it requires a trustpoint to be configured
And now we configure IPSec (phase-2 tunnel):
1. Go to the IPSec tab
2. Select a suitable IPSec proposal (If you’re not sure, leave the defaults in place)
3. Enable Reverse Route Injection to add protected networks into the local routing table
4. Optionally, enable Perfect Forward Secrecy. If you’re not sure, leave it enabled
Additional Configuration
There are a few final things that you may want to consider for your environment.
NAT Exemption– If you use NAT, you will need to create an exemption for the traffic going over
the VPN.
Dynamic Routing– Reverse Route Injection gets the route into the local routing table, but it doesn’t
go any further. If you want to advertise this route, you need to redistribute it into your IGP.
Policy Deployment– Remember that your changes will not take effect until you deploy them to
your devices.

FTD Site To Site VPN

Uploaded by

Copyright:

Available Formats

FTD Site To Site VPN

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

FTD Site To Site VPN

Uploaded by

Copyright:

Available Formats

What are the different VPN topologies supported in FMC?

What are the steps to configure an IKE phase 1 tunnel?

Firewalls running Threat Defence support site to site (AKA LAN-to-LAN) VPNs.

You might also like