Cisco Ftd

---
name: cisco-ftd
description: "Expert coverage of Cisco Secure Firewall Threat Defense (FTD): LINA+Snort dual-engine architecture, Access Control Policy, Prefilter, Snort 3 IPS, FMC/CDO management, SSL decryption, NAT, identity policy, HA/clustering, and CLI diagnostics. Use for \"FTD\", \"Cisco Secure Firewall\", \"Snort 3\", \"FMC\", \"Firepower\", \"CDO\", \"Prefilter\", \"packet-tracer\", \"show asp drop\", \"sftunnel\", \"SnortML\". Do NOT use for cross-vendor comparison, platform selection, or category-wide architecture -- use the `firewall` skill."
license: MIT
---

# Cisco FTD

This skill covers Cisco Secure Firewall Threat Defense (FTD) across all supported versions (7.2 through 7.7). Areas of expertise include:

- Dual-engine architecture (LINA + Snort)
- Access Control Policy (ACP) with L3-L7 rule matching
- Prefilter policy for FastPath bypass
- Snort 3 IPS engine with Talos intelligence
- FMC (Firewall Management Center) centralized management
- CDO / cdFMC (cloud-delivered management)
- SSL/TLS decryption policy
- Identity policy (AD Agent, ISE, Azure AD, Passive Identity Agent)
- NAT (Auto-NAT, Manual/Twice-NAT, Section 1/2/3 ordering)
- File/Malware policy (AMP for Networks, Threat Grid)
- HA (Active/Standby failover, clustering, multi-instance)
- CLI troubleshooting (CLISH + diagnostic-cli/LINA)
- Automation (FMC REST API, Ansible cisco.fmcansible, Terraform)

When a question is version-specific, delegate to the version agent. When the version is unknown, provide general guidance.

## How to Approach Tasks

1. **Classify** the request:
   - **Troubleshooting** -- Load `references/diagnostics.md` for packet-tracer, ASP drops, captures
   - **Policy design** -- Apply ACP best practices below
   - **Architecture** -- Load `references/architecture.md` for dual-engine, packet flow, HA
   - **Administration** -- Follow FMC management and deployment guidance
   - **Migration** -- ASA-to-FTD migration workflow

2. **Identify version** -- Determine which FTD version. FMC version must match or exceed FTD version. Platform matters for feature availability.

3. **Load context** -- Read relevant reference file.

4. **Analyze** -- Apply FTD-specific reasoning. Understand that LINA and Snort are separate engines with different roles.

5. **Recommend** -- Provide specific guidance with CLI/FMC paths.

6. **Verify** -- Suggest validation: packet-tracer, show conn, show asp drop, capture.

## Dual-Engine Architecture

### LINA Engine (ASA Code)
Handles L2-L4 processing: MAC/ARP/VLAN, routing (OSPF/BGP/EIGRP), NAT, VPN termination (IPsec/SSL), Prefilter policy, L3/L4 ACL enforcement, stateful connection tracking, hardware bypass.

Access LINA CLI: `system support diagnostic-cli` from FTD CLISH.

**Important**: Changes in diagnostic-cli are overwritten on next FMC policy deploy. Use for read-only diagnostics only.

### Snort Engine (L7 Inspection)
Handles: Security Intelligence (IP/URL/DNS reputation), SSL/TLS policy, URL filtering, Application identification (AppID), Identity policy, ACP L7 rules, IPS (Snort rules), File/Malware policy.

**Critical behavior**: Snort does NOT drop packets directly. It returns a verdict (drop/allow/trust) to LINA. LINA acts on the verdict. Snort failure behavior depends on Fail-Open vs. Fail-Close configuration.

### Packet Flow
```
Ingress -> LINA (L2, routing, Prefilter, NAT un-translate, VPN decrypt, L3/L4 ACL)
  -> Snort (SI, SSL Policy, URL/App/User rules, IPS, File/Malware)
  -> LINA (apply Snort verdict, NAT translate, VPN encrypt, route, egress)
```

**FastPath**: Prefilter Trust rules bypass Snort entirely. Highest performance path. Use for trusted high-volume traffic (backup jobs, replication).

## Access Control Policy (ACP)

### Rule Actions
| Action | Behavior |
|---|---|
| Allow | Permit; apply IPS, file, and malware policy |
| Trust | Permit; bypass Snort (LINA-only, no deep inspection) |
| Block | Deny immediately |
| Block with Reset | Deny + TCP RST |
| Interactive Block | HTTP block page with user override option |
| Monitor | Log only; continue rule evaluation |

### Rule Matching
- Source/destination networks, ports, VLANs
- Security zones (interface groups)
- Applications (L7 AppID -- requires Snort)
- URL categories/reputations (requires license)
- Users/groups (requires Identity Policy)
- File types (for File Policy attachment)

### Best Practices
- Use Prefilter FastPath for known-good high-volume traffic
- Default action: Intrusion Prevention (not Block) to get IPS coverage on unmatched traffic
- Attach IPS policy to Allow rules for defense in depth
- Use Security Intelligence to block known-bad before ACP evaluation
- Monitor rules for traffic profiling before enforcement

## NAT Architecture

Same as ASA (LINA-based):
- **Section 1 (Manual NAT, pre-auto)**: First match wins
- **Section 2 (Auto-NAT)**: Object-based, auto-ordered by specificity
- **Section 3 (Manual NAT, `after-auto`)**: Catch-all manual rules

**Identity NAT for VPN** (prevent VPN traffic from being NAT'd):
```
nat (inside,outside) source static INSIDE_NET INSIDE_NET destination static REMOTE_VPN REMOTE_VPN no-proxy-arp route-lookup
```

## FMC Management

- FMC version must be >= FTD version (always upgrade FMC first)
- sftunnel: Encrypted tunnel over TCP 8305 for FMC-FTD communication
- Registration: `configure manager add <FMC_IP> <reg_key>` on FTD
- **cdFMC**: Cloud-delivered FMC via CDO/Security Cloud Control -- no on-premises appliance needed

### Policy Deployment
1. FMC collects policies -> builds Snort + LINA packages -> transfers via sftunnel
2. Snort 3: reload (minimal disruption); Snort 2: restart (brief inspection gap)
3. LINA config applied; rollback on failure
4. Deploy to a subset of devices first for significant changes

## FlexConfig

CLI pass-through to LINA for features not yet surfaced in FMC:
- `sysopt connection permit-vpn`
- TCP normalization, EIGRP advanced options, complex PBR
- **Risk**: FMC may overwrite FlexConfig on full deploy. Use sparingly; prefer native FMC features.

## Common Pitfalls

1. **LINA vs Snort confusion**: Understand which engine handles what. Routing issues are LINA. Application identification is Snort. ASP drops are LINA-side. Snort drops show in `show asp drop` as `snort-drop`.

2. **Policy deploy disruption**: Snort 3 reload is minimal but not zero. Snort 2 restart causes brief inspection gap. Plan deploys during maintenance windows for major changes.

3. **FMC version mismatch**: FMC must always be same or newer than FTD. Cannot upgrade FTD past FMC version. Upgrade FMC first.

4. **Trust vs Allow**: Trust bypasses Snort entirely (no IPS, no file inspection, no URL filtering). Only use for traffic that truly needs no inspection.

5. **No multi-context**: FTD does not support security contexts (ASA feature). Each context requires a separate FTD instance. This is the primary reason to keep ASA.

6. **FlexConfig fragility**: FlexConfig settings can be overwritten on full policy deploy. Document all FlexConfig entries and test after each deploy.

7. **Snort fail-open risk**: If configured as fail-open, Snort failure allows uninspected traffic. If fail-close, Snort failure drops all traffic. Choose based on availability vs. security priority.

8. **Firepower 2100 deprecation**: 2100 series (2110/2120/2130/2140) not supported on FTD 7.6+. Plan hardware refresh if on these platforms.

## Version-Specific Guidance

| Version | Reference | What's version-specific |
|---|---|---|
| 7.6 | `references/versions/7.6.md` | SnortML, Snort 3 mandatory, QUIC decryption, AI Assistant, Policy Analyzer, Secure Firewall 1200, SD-WAN Wizard, Passive Identity Agent |

## Reference Files

- `references/architecture.md` -- LINA+Snort dual engine, packet flow, Prefilter, deployment modes (routed/transparent/inline/passive), FMC/CDO/FDM, HA, clustering, multi-instance. Read for "how does X work" questions.
- `references/diagnostics.md` -- CLISH commands, diagnostic-cli (LINA), packet-tracer, show asp drop, captures, connection table, Snort troubleshooting, VPN commands, FMC REST API. Read when troubleshooting.