在内联对模式下配置FTD接口
目录
简介
本文档介绍Firepower威胁防御(FTD)设备上的内联对接口的配置、验证和操作。
先决条件
要求
本文档没有任何特定的要求。
使用的组件
本文档中的信息基于以下软件和硬件版本：
- Firepower 4112 FTD（代码7.x）
- Firepower管理中心(FMC)（代码7.x）
本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始（默认）配置。如果您的网络处于活动状态，请确保您了解所有命令的潜在影响。
相关产品
本文档还可与以下硬件和软件版本一起使用：
- FPR1000、FPR2100、FPR4100、FPR9300
- 安全防火墙3100和4200系列
- vFTD
- FTD软件代码6.2.x及更高版本
背景信息
FTD 是由两个主要引擎组成的统一软件映像：
- LINA 引擎
- Snort 引擎
下图显示了这两个引擎的交互方式：
- 数据包进入入口接口并由 LINA 引擎处理.
- 如果FTD策略需要该数据包，则由Snort引擎检查该数据包。
- Snort引擎返回数据包的判定。
- LINA 引擎根据 Snort 的判定丢弃或转发数据包.
FTD提供两种部署模式和六种接口模式，如图所示：
以下是各种FTD部署和接口模式的简要概述：
| FTD接口模式 |
FTD部署模式 |
描述 |
可以丢弃流量 |
| 已路由 |
已路由 |
完整的LINA引擎和Snort引擎检查。 |
Yes |
| 交换 |
透明 |
完整的LINA引擎和Snort引擎检查。 |
Yes |
| 内联对 |
路由或透明 |
部分LINA引擎和完整Snort引擎检查。 |
Yes |
| 带分路器的内联对 |
路由或透明 |
部分LINA引擎和完整Snort引擎检查。 |
无 |
| 被动 |
路由或透明 |
部分LINA引擎和完整Snort引擎检查。 |
无 |
| 被动(ERSPAN) |
已路由 |
部分LINA引擎和完整Snort引擎检查。 |
无 |
在FTD上配置内联对接口
网络图
要求
按照以下要求在内联对模式下配置物理接口e1/3和e1/4:
| 接口 | e1/3 | e1/4 |
| 名称 | 内部 | 外部 |
| 安全区域 | INSIDE_ZONE | OUTSIDE_ZONE |
| 内联集名称 | 内联对1 | |
| 内联集MTU | 1500 | |
| 传播链路状态 | 启用 |
解决方案
步骤1.要配置到各个接口，请导航到Devices > Device Management，选择适当的设备，然后选择Edit:
接下来，为接口指定Name和Enabled，如图所示。
同样，对于接口Ethernet1/4。最后结果如下所示：
步骤2.配置内联对。
导航到内联集>添加内联集，如图所示。
步骤3.按照图中所示的要求配置General设置。
步骤4.在Advanced Settings中启用Propagate Link State选项，如图所示。
当内联集中的一个接口关闭时，链路状态传播会自动关闭内联接口对中的第二个接口。
步骤5.保存更改并进行部署。
验证
使用本部分可确认配置能否正常运行。
从FTD CLI验证内联对配置。
解决方案
登录到FTD CLI并验证内联对配置：
firepower# show inline-set
Inline-set Inline-Pair-1
Mtu is 1500 bytes
Fail-open for snort down is on
Fail-open for snort busy is off
Tap mode is off
Propagate-link-state option is on
hardware-bypass mode is disabled
Interface-Pair[1]:
Interface: Ethernet1/4 "OUTSIDE"
Current-Status: UP
Interface: Ethernet1/3 "INSIDE"
Current-Status: UP
Bridge Group ID: 507
接口和名称信息：
firepower# show nameif
Interface Name Security
Ethernet1/1 management 0
Ethernet1/3 INSIDE 0
Ethernet1/4 OUTSIDE 0
检验接口状态：
firepower# show interface ip brief
Interface IP-Address OK? Method Status Protocol
Internal-Control0/0 unassigned YES unset up up
Internal-Data0/0 unassigned YES unset up up
Internal-Data0/1 unassigned YES unset up up
Internal-Data0/2 169.254.1.1 YES unset up up
Internal-Data0/3 unassigned YES unset up up
Internal-Data0/4 unassigned YES unset down up
Ethernet1/1 203.0.113.130 YES unset up up
Ethernet1/3 unassigned YES unset up up
Ethernet1/4 unassigned YES unset up up
检验物理接口信息：
firepower# show interface e1/3
Interface Ethernet1/3 "INSIDE", is up, line protocol is up
Hardware is EtherSVI, BW 1000 Mbps, DLY 10 usec
MAC address ac4a.670e.641e, MTU 1500
IPS Interface-Mode: inline, Inline-Set: Inline-Pair-1
IP address unassigned
Traffic Statistics for "INSIDE":
170 packets input, 12241 bytes
41 packets output, 7881 bytes
9 packets dropped
1 minute input rate 0 pkts/sec, 37 bytes/sec
1 minute output rate 0 pkts/sec, 19 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 0 pkts/sec, 34 bytes/sec
5 minute output rate 0 pkts/sec, 23 bytes/sec
5 minute drop rate, 0 pkts/sec
检验FTD内联对接口操作
本节介绍以下验证检查以验证内联对操作：
- 验证1.使用Packet Tracer。
- 验证2.启用带有跟踪的捕获，并通过内联对发送TCP同步/确认(SYN/ACK)数据包。
- 验证3.使用防火墙引擎调试监控FTD流量
- 验证4.验证链路状态传播功能。
- 验证5.配置静态网络地址转换(NAT)。
解决方案
架构概述
当2个FTD接口在内联对模式下运行时，会处理数据包，如图所示。
基本原理
- 当您配置内联对2物理时，接口在内部桥接。
- 非常类似于经典的内联入侵防御系统(IPS)。
- 在路由或透明部署模式下可用。
- 大多数LINA引擎功能（NAT、路由等）对于通过内联对的流不可用。
- 可以丢弃中转流量。
- 一些LINA引擎检查与完整的Snort引擎检查一起应用。
最后一点可以可视化，如图所示：
验证1.使用Packet Tracer
Packet Tracer输出模拟经过内联对的数据包，其中突出显示的重要点：
firepower# packet-tracer input INSIDE tcp 192.168.201.50 1111 192.168.202.50 80
Phase: 1
Type: NGIPS-MODE
Subtype: ngips-mode
Result: ALLOW
Elapsed time: 11834 ns
Config:
Additional Information:
The flow ingressed an interface configured for NGIPS mode and NGIPS services will be applied
Phase: 2
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Elapsed time: 11834 ns
Config:
access-group CSM_FW_ACL_ global
access-list CSM_FW_ACL_ advanced permit ip host 192.168.201.50 host 192.168.202.50 rule-id 268451044
access-list CSM_FW_ACL_ remark rule-id 268451044: ACCESS POLICY: mzafeiro_2m - Mandatory
access-list CSM_FW_ACL_ remark rule-id 268451044: L7 RULE: New-Rule-#1303-ALLOW
Additional Information:
This packet will be sent to snort for additional processing where a verdict will be reached
Phase: 3
Type: NGIPS-EGRESS-INTERFACE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Elapsed time: 2440 ns
Config:
Additional Information:
Ingress interface INSIDE is in NGIPS inline mode.
Egress interface OUTSIDE is determined by inline-set configuration
Phase: 4
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Elapsed time: 68320 ns
Config:
Additional Information:
New flow created with id 1801, packet dispatched to next module
Phase: 5
Type: EXTERNAL-INSPECT
Subtype:
Result: ALLOW
Elapsed time: 18056 ns
Config:
Additional Information:
Application: 'SNORT Inspect'
Phase: 6
Type: SNORT
Subtype: identity
Result: ALLOW
Elapsed time: 13668 ns
Config:
Additional Information:
user id: no auth, realm id: 0, device type: 0, auth type: invalid, auth proto: basic, username: none, AD domain: none,
src sgt: 0, src sgt type: unknown, dst sgt: 0, dst sgt type: unknown, abp src: none, abp dst: none, location: none
Phase: 7
Type: SNORT
Subtype: firewall
Result: ALLOW
Elapsed time: 67770 ns
Config:
Network 0, Inspection 0, Detection 0, Rule ID 268451044
Additional Information:
Starting rule matching, zone -1 -> -1, geo 0 -> 0, vlan 0, src sgt: 0, src sgt type: unknown, dst sgt: 0, dst sgt type: unknown, user 9999997, no url or host, no xff
Matched rule ids 268451044 - Allow
Phase: 8
Type: SNORT
Subtype: appid
Result: ALLOW
Elapsed time: 11002 ns
Config:
Additional Information:
service: (0), client: (0), payload: (0), misc: (0)
Result:
input-interface: INSIDE(vrfid:0)
input-status: up
input-line-status: up
output-interface: OUTSIDE(vrfid:0)
output-status: up
output-line-status: up
Action: allow
Time Taken: 204924 ns
验证2.通过内联对发送TCP SYN/ACK数据包
您可以使用可设计实用程序（如Scapy）的数据包生成TCP SYN/ACK数据包。此语法生成启用了SYN/ACK标志的3个数据包：
root@KALI:~# scapy INFO: Can't import python gnuplot wrapper . Won't be able to plot. WARNING: No route found for IPv6 destination :: (no default route?) Welcome to Scapy (2.2.0) >>> conf.iface='eth0' >>> packet = IP(dst="192.168.201.60")/TCP(flags="SA",dport=80) >>> syn_ack=[] >>> for i in range(0,3): # Send 3 packets ... syn_ack.extend(packet) ... >>> send(syn_ack)
在FTD CLI上启用此捕获并发送一些TCP SYN/ACK数据包：
firepower# capture CAPI interface INSIDE trace match ip host 192.168.201.60 any
firepower# capture CAPO interface OUTSIDE match ip host 192.168.201.60 any
捕获显示3个SYN/ACK数据包经过FTD:
firepower# show capture CAPI
3 packets captured
1: 09:20:18.206440 192.168.201.50.20 > 192.168.201.60.80: S 0:0(0) ack 0 win 8192
2: 09:20:18.208180 192.168.201.50.20 > 192.168.201.60.80: S 0:0(0) ack 0 win 8192
3: 09:20:18.210026 192.168.201.50.20 > 192.168.201.60.80: S 0:0(0) ack 0 win 8192
3 packets shown
firepower# show capture CAPO
3 packets captured
1: 09:20:18.206684 192.168.201.50.20 > 192.168.201.60.80: S 0:0(0) ack 0 win 8192
2: 09:20:18.208210 192.168.201.50.20 > 192.168.201.60.80: S 0:0(0) ack 0 win 8192
3: 09:20:18.210056 192.168.201.50.20 > 192.168.201.60.80: S 0:0(0) ack 0 win 8192
3 packets shown
第一个捕获数据包的Trace显示一些附加信息，如Snort引擎判定：
firepower# show capture CAPI packet-number 1 trace
3 packets captured
1: 09:20:18.206440 192.168.201.50.20 > 192.168.201.60.80: S 0:0(0) ack 0 win 8192
Phase: 1
Type: NGIPS-MODE
Subtype: ngips-mode
Result: ALLOW
Elapsed time: 5978 ns
Config:
Additional Information:
The flow ingressed an interface configured for NGIPS mode and NGIPS services will be applied
Phase: 2
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Elapsed time: 5978 ns
Config:
access-group CSM_FW_ACL_ global
access-list CSM_FW_ACL_ advanced permit ip host 192.168.201.50 object-group FMC_INLINE_dst_rule_268451044 rule-id 268451044
access-list CSM_FW_ACL_ remark rule-id 268451044: ACCESS POLICY: mzafeiro_2m - Mandatory
access-list CSM_FW_ACL_ remark rule-id 268451044: L7 RULE: New-Rule-#1303-ALLOW
object-group network FMC_INLINE_dst_rule_268451044
network-object 192.168.202.50 255.255.255.255
network-object 192.168.201.60 255.255.255.255
Additional Information:
This packet will be sent to snort for additional processing where a verdict will be reached
Phase: 3
Type: NGIPS-EGRESS-INTERFACE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Elapsed time: 1952 ns
Config:
Additional Information:
Ingress interface INSIDE is in NGIPS inline mode.
Egress interface OUTSIDE is determined by inline-set configuration
Phase: 4
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Elapsed time: 45872 ns
Config:
Additional Information:
New flow created with id 1953, packet dispatched to next module
Phase: 5
Type: EXTERNAL-INSPECT
Subtype:
Result: ALLOW
Elapsed time: 18544 ns
Config:
Additional Information:
Application: 'SNORT Inspect'
Phase: 6
Type: SNORT
Subtype: identity
Result: ALLOW
Elapsed time: 25182 ns
Config:
Additional Information:
user id: no auth, realm id: 0, device type: 0, auth type: invalid, auth proto: basic, username: none, AD domain: none,
src sgt: 0, src sgt type: unknown, dst sgt: 0, dst sgt type: unknown, abp src: none, abp dst: none, location: none
Phase: 7
Type: SNORT
Subtype: firewall
Result: ALLOW
Elapsed time: 50924 ns
Config:
Network 0, Inspection 0, Detection 0, Rule ID 268451044
Additional Information:
Starting rule matching, zone -1 -> -1, geo 0 -> 0, vlan 0, src sgt: 0, src sgt type: unknown, dst sgt: 0, dst sgt type: unknown, user 9999997, no url or host, no xff
Matched rule ids 268451044 - Allow
Phase: 8
Type: SNORT
Subtype: appid
Result: ALLOW
Elapsed time: 17722 ns
Config:
Additional Information:
service: (0), client: (0), payload: (0), misc: (0)
Result:
input-interface: INSIDE(vrfid:0)
input-status: up
input-line-status: up
output-interface: OUTSIDE(vrfid:0)
output-status: up
output-line-status: up
Action: allow
Time Taken: 172152 ns
1 packet shown
第二个捕获的数据包的跟踪显示数据包与当前连接匹配，因此它会绕过ACL检查，但仍由Snort引擎进行检查：
firepower# show capture CAPI packet-number 2 trace
3 packets captured
2: 09:20:18.208180 192.168.201.50.20 > 192.168.201.60.80: S 0:0(0) ack 0 win 8192
Phase: 1
Type: FLOW-LOOKUP
Subtype:
Result: ALLOW
Elapsed time: 1952 ns
Config:
Additional Information:
Found flow with id 1953, using existing flow
Phase: 2
Type: EXTERNAL-INSPECT
Subtype:
Result: ALLOW
Elapsed time: 7320 ns
Config:
Additional Information:
Application: 'SNORT Inspect'
Phase: 3
Type: SNORT
Subtype: appid
Result: ALLOW
Elapsed time: 1860 ns
Config:
Additional Information:
service: (0), client: (0), payload: (0), misc: (0)
Result:
input-interface: INSIDE(vrfid:0)
input-status: up
input-line-status: up
Action: allow
Time Taken: 11132 ns
1 packet shown
验证3.防火墙引擎调试允许的流量
防火墙引擎调试针对FTD Snort引擎的特定组件（如访问控制策略）运行，如图所示：
通过内联对发送TCP SYN/ACK数据包时，可以在debug输出中看到：
> system support firewall-engine-debug
Please specify an IP protocol: tcp
Please specify a client IP address:
Please specify a client port:
Please specify a server IP address: 192.168.201.60
Please specify a server port: 80
Monitoring firewall engine debug messages
192.168.201.60-80 > 192.168.201.50-20 6 AS 4 I 12 New session
192.168.201.60-80 > 192.168.201.50-20 6 AS 4 I 12 using HW or preset rule order 3, id 268438528 action Allow and prefilter rule 0
192.168.201.60-80 > 192.168.201.50-20 6 AS 4 I 12 allow action
192.168.201.60-80 > 192.168.201.50-20 6 AS 4 I 12 Deleting session
验证4.验证链路状态传播
启用FTD上的缓冲区日志并关闭连接到e1/4接口的交换机端口。在FTD CLI上，您必须看到两个接口都关闭：
firepower# show interface ip brief
Interface IP-Address OK? Method Status Protocol
Internal-Control0/0 unassigned YES unset up up
Internal-Data0/0 unassigned YES unset up up
Internal-Data0/1 unassigned YES unset up up
Internal-Data0/2 169.254.1.1 YES unset up up
Internal-Data0/3 unassigned YES unset up up
Internal-Data0/4 unassigned YES unset down up
Ethernet1/1 203.0.113.130 YES unset up up
Ethernet1/3 unassigned YES unset admin down down
Ethernet1/4 unassigned YES unset down down
FTD日志显示：
firepower# show log
...
May 28 2024 07:35:10: %FTD-4-411002: Line protocol on Interface Ethernet1/4, changed state to down
May 28 2024 07:35:10: %FTD-4-411004: Interface INSIDE, changed state to administratively down
May 28 2024 07:35:10: %FTD-4-411004: Interface Ethernet1/3, changed state to administratively down
May 28 2024 07:35:10: %FTD-4-812005: Link-State-Propagation activated on inline-pair due to failure of interface Ethernet1/4(OUTSIDE) bringing down pair interface Ethernet1/3(INSIDE)
May 28 2024 07:35:10: %FTD-4-411002: Line protocol on Interface Ethernet1/3, changed state to down
内联集状态显示两个接口成员的状态：
firepower# show inline-set
Inline-set Inline-Pair-1
Mtu is 1500 bytes
Fail-open for snort down is on
Fail-open for snort busy is off
Tap mode is off
Propagate-link-state option is on
hardware-bypass mode is disabled
Interface-Pair[1]:
Interface: Ethernet1/4 "OUTSIDE"
Current-Status: Down(Propagate-Link-State-Activated)
Interface: Ethernet1/3 "INSIDE"
Current-Status: Down(Administrative-Down-By-Propagate-Link-State)
Bridge Group ID: 507
注意两个接口状态的差异：
firepower# show interface e1/3
Interface Ethernet1/3 "INSIDE", is admin down, line protocol is down
Hardware is EtherSVI, BW 1000 Mbps, DLY 10 usec
MAC address ac4a.670e.641e, MTU 1500
IPS Interface-Mode: inline, Inline-Set: Inline-Pair-1
Administrative-Down-By-Propagate-Link-State
IP address unassigned
Traffic Statistics for "INSIDE":
2400 packets input, 165873 bytes
1822 packets output, 178850 bytes
17 packets dropped
1 minute input rate 0 pkts/sec, 0 bytes/sec
1 minute output rate 0 pkts/sec, 0 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 0 pkts/sec, 32 bytes/sec
5 minute output rate 0 pkts/sec, 57 bytes/sec
5 minute drop rate, 0 pkts/sec
firepower# show interface e1/4
Interface Ethernet1/4 "OUTSIDE", is down, line protocol is down
Hardware is EtherSVI, BW 1000 Mbps, DLY 10 usec
MAC address ac4a.670e.640e, MTU 1500
IPS Interface-Mode: inline, Inline-Set: Inline-Pair-1
Propagate-Link-State-Activated
IP address unassigned
Traffic Statistics for "OUTSIDE":
1893 packets input, 158046 bytes
2386 packets output, 213997 bytes
67 packets dropped
1 minute input rate 0 pkts/sec, 0 bytes/sec
1 minute output rate 0 pkts/sec, 0 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 0 pkts/sec, 51 bytes/sec
5 minute output rate 0 pkts/sec, 39 bytes/sec
5 minute drop rate, 0 pkts/sec
重新启用交换机端口后，FTD日志显示：
May 28 2024 07:38:04: %FTD-4-411001: Line protocol on Interface Ethernet1/4, changed state to up
May 28 2024 07:38:04: %FTD-4-411003: Interface Ethernet1/3, changed state to administratively up
May 28 2024 07:38:04: %FTD-4-411003: Interface INSIDE, changed state to administratively up
May 28 2024 07:38:04: %FTD-4-812006: Link-State-Propagation de-activated on inline-pair due to recovery of interface Ethernet1/4(OUTSIDE) bringing up pair interface Ethernet1/3(INSIDE)
May 28 2024 07:38:05: %FTD-4-411002: Line protocol on Interface Ethernet1/4, changed state to down
验证5.配置静态NAT
解决方案
内联、内联分路器或被动模式下运行的接口不支持NAT:
内联对接口模式上的阻止数据包
创建阻止规则，通过FTD内联对发送流量，并观察行为，如图所示。
解决方案
通过跟踪启用捕获，并通过FTD内联对发送SYN/ACK数据包。流量被阻止：
firepower# show capture
capture CAPI type raw-data trace interface INSIDE [Capturing - 270 bytes]
match ip host 192.168.201.60 any
capture CAPO type raw-data interface OUTSIDE [Capturing - 0 bytes]
match ip host 192.168.201.60 any
在跟踪中可以看到，数据包被FTD LINA引擎丢弃，并且未转发到FTD Snort引擎。
firepower# show capture CAPI packet-number 1 trace
4 packets captured
1: 09:41:54.562547 192.168.201.50.59144 > 192.168.201.60.80: S 3817586151:3817586151(0) win 64240 <mss 1460,sackOK,timestamp 2568467664 0,nop,wscale 7>
Phase: 1
Type: NGIPS-MODE
Subtype: ngips-mode
Result: ALLOW
Elapsed time: 10126 ns
Config:
Additional Information:
The flow ingressed an interface configured for NGIPS mode and NGIPS services will be applied
Phase: 2
Type: ACCESS-LIST
Subtype:
Result: DROP
Elapsed time: 10126 ns
Config:
access-group CSM_FW_ACL_ global
access-list CSM_FW_ACL_ advanced deny ip any host 192.168.201.60 rule-id 268451045 event-log flow-start
access-list CSM_FW_ACL_ remark rule-id 268451045: ACCESS POLICY: mzafeiro_2m - Mandatory
access-list CSM_FW_ACL_ remark rule-id 268451045: L4 RULE: block_192.168.201.60
Additional Information:
Result:
input-interface: INSIDE(vrfid:0)
input-status: up
input-line-status: up
Action: drop
Time Taken: 20252 ns
1 packet shown
使用Tap配置内联对模式
在内联对上启用分路模式。
解决方案
导航到设备>设备管理>内联集>编辑内联集>高级并启用分路模式，如图所示。
确认
firepower# show inline-set
Inline-set Inline-Pair-1
Mtu is 1500 bytes
Fail-open for snort down is off
Fail-open for snort busy is off
Tap mode is on
Propagate-link-state option is on
hardware-bypass mode is disabled
Interface-Pair[1]:
Interface: Ethernet1/4 "OUTSIDE"
Current-Status: UP
Interface: Ethernet1/3 "INSIDE"
Current-Status: UP
Bridge Group ID: 0
使用分路接口验证FTD内联对
基本原理
- 使用分路器配置内联对时，物理接口在内部桥接。
- 它在路由或透明部署模式下可用。
- 大多数LINA引擎功能（NAT、路由等）对于通过内联对的流不可用。
- 无法丢弃实际流量。
- 一些LINA引擎检查与完整的Snort引擎检查一起应用于实际流量的副本。
带分路模式的内联对不会丢弃中转流量。通过数据包的跟踪，可以确认以下情况：
> show capture CAPI packet-number 2 trace 3 packets captured 2: 13:34:30.685084 192.168.201.50.20 > 192.168.201.60.80: S 0:0(0) win 8192 Phase: 1 Type: CAPTURE Subtype: Result: ALLOW Config: Additional Information: MAC Access list Phase: 2 Type: ACCESS-LIST Subtype: Result: ALLOW Config: Implicit Rule Additional Information: MAC Access list Phase: 3 Type: NGIPS-MODE Subtype: ngips-mode Result: ALLOW Config: Additional Information: The flow ingressed an interface configured for NGIPS mode and NGIPS services is applied Phase: 4 Type: ACCESS-LIST Subtype: log Result: WOULD HAVE DROPPED Config: access-group CSM_FW_ACL_ global access-list CSM_FW_ACL_ advanced deny ip 192.168.201.0 255.255.255.0 any rule-id 268441600 event-log flow-start access-list CSM_FW_ACL_ remark rule-id 268441600: ACCESS POLICY: FTD4100 - Mandatory/1 access-list CSM_FW_ACL_ remark rule-id 268441600: L4 RULE: Rule 1 Additional Information: Result: input-interface: INSIDE input-status: up input-line-status: up Action: Access-list would have dropped, but packet forwarded due to inline-tap 1 packet shown
>
内联对和Etherchannel
您可以通过两种方式配置与etherchannel的内联对：
- Etherchannel在FTD上终止。
- Etherchannel通过FTD（需要FXOS代码2.3.1.3及更高版本）。
Etherchannel在FTD上终止
SW-A上的Etherchannel:
SW-A# show etherchannel summary | i Po33|Po55 33 Po33(SU) LACP Gi3/11(P) 35 Po35(SU) LACP Gi2/33(P)
SW-B上的Etherchannel:
SW-B# show etherchannel summary | i Po33|Po55 33 Po33(SU) LACP Gi1/0/3(P) 55 Po55(SU) LACP Gi1/0/4(P)
根据MAC地址学习，通过活动FTD转发流量：
SW-B# show mac address-table address 0017.dfd6.ec00
Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
201 0017.dfd6.ec00 DYNAMIC Po33
Total Mac Addresses for this criterion: 1
FTD上的内联集：
FTD# show inline-set
Inline-set SET1
Mtu is 1500 bytes
Fail-open for snort down is on
Fail-open for snort busy is off
Tap mode is off
Propagate-link-state option is off
hardware-bypass mode is disabled
Interface-Pair[1]:
Interface: Port-channel3 "INSIDE"
Current-Status: UP
Interface: Port-channel5 "OUTSIDE"
Current-Status: UP
Bridge Group ID: 775
通过FTD的Etherchannel
SW-A上的Etherchannel:
SW-A# show etherchannel summary | i Po33|Po55
33 Po33(SU) LACP Gi3/11(P)
55 Po55(SD) LACP Gi3/7(I)
阻止通过备用FTD的LACP数据包：
FTD# capture ASP type asp-drop fo-standby FTD# show capture ASP | i 0180.c200.0002 29: 15:28:32.658123 a0f8.4991.ba03 0180.c200.0002 0x8809 Length: 124 70: 15:28:47.248262 f0f7.556a.11e2 0180.c200.0002 0x8809 Length: 124
SW-B上的Etherchannel:
SW-B# show etherchannel summary | i Po33|Po55
33 Po33(SU) LACP Gi1/0/3(P)
55 Po55(SD) LACP Gi1/0/4(s)
根据MAC地址学习，通过活动FTD转发流量：
SW-B# show mac address-table address 0017.dfd6.ec00
Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
201 0017.dfd6.ec00 DYNAMIC Po33
Total Mac Addresses for this criterion: 1
FTD上的内联集：
FTD# show inline-set
Inline-set SET1
Mtu is 1500 bytes
Fail-open for snort down is on
Fail-open for snort busy is off
Tap mode is off
Propagate-link-state option is off
hardware-bypass mode is disabled
Interface-Pair[1]:
Interface: Ethernet1/3 "INSIDE"
Current-Status: UP
Interface: Ethernet1/5 "OUTSIDE"
Current-Status: UP
Bridge Group ID: 519
故障排除
当前没有可用于此配置的特定信息。
比较：内联对与带分路的内联对
| 内联对 |
带分路器的内联对 |
|
| show inline-set |
> show inline-set |
> show inline-set > |
| show interface |
> show interface e1/6 |
> show interface e1/6 |
| 使用阻止规则处理数据包 |
> show capture CAPI packet-number 1 trace |
> show capture CAPI packet-number 1 trace |
摘要
- 使用内联对模式时，数据包主要通过FTD Snort引擎。
- TCP连接在TCP状态旁路模式下处理。
- 从FTD LINA引擎的角度来看，会应用ACL策略。
- 当内联对模式处于使用状态时，由于数据包是内联处理的，因此可以阻止它们。
- 启用分路模式时，数据包副本会在内部进行检测并丢弃，同时实际流量不会经过修改的FTD。
相关信息
修订历史记录
| 版本 | 发布日期 | 备注 |
|---|---|---|
3.0 |
18-Nov-2024 |
已删除Cisco Internal Information Box（思科内部信息框），因为找不到链接。更新的简介、替代文本和格式。 |
2.0 |
28-Apr-2023 |
重新认证 |
1.0 |
18-Oct-2017 |
初始版本 |
反馈