Cisco FTDv Firewall Initial Configuration issue with connectivity to AWS VPC

0

Hello AWS Community

I have an issue with the initial configuration on a Cisco FTDv Firewall FDM, pretty much the issue is that I cannot seem to receive the traffic on the FTDv when I try to reach any Public addresses , a little bit about the setup

4 Interfaces (Inside, Outside, MGMT and Diagnostic)

From the FTDv directly I can ping google(8.8.8.8) without issues

From the subnets on AWS I can ping all interfaces of the FTDv, but not to google or any public subnet.

I did a packet tracer test on the FIrewall simulating any of the servers I have on AWS and traffic is allowed correctly.

However I never see the attempts reaching the FTD when I ping google or any public IP if I do it from the servers on the AWS VPC.

In the VPC my next hop for 0.0.0.0/0 is the Inside Interface NIC of the FTDv

PD: I do see the traffic of the servers in the Inside interface when I ping the interfaces of the FTDv since those are working fine. but not when I ping anything Public.

I also setup a capture on the FTDv and I never see attempts of the internal servers only when try to reach anything Public.

Seems like an issue between the FTDv and AWS Vpc

Hoping somebody has some insight on it

Thanks in Advance

1개 답변
1
수락된 답변

Hi, Thank you for reaching out.

If done already, could you try to disable source/destination checks on the FTDv instance and see if that helps.

Each EC2 instance performs source/destination checks by default. This means that the instance must be the source or destination of any traffic it sends or receives. However, a NAT instance must be able to send and receive traffic when the source or destination is not itself. Therefore, you must disable source/destination checks on the NAT instance.

You can disable the SrcDestCheck attribute for a NAT instance that's either running or stopped using the console or the command line.

See below to get more details on the feature and how-to:

https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Instance.html#EIP_Disable_SrcDestCheck

https://aws.amazon.com/blogs/aws/new-vpc-ingress-routing-simplifying-integration-of-third-party-appliances/

HTH

AWS
AdeshG
답변함 2년 전
  • Excellent this was the issue thank you so much

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠