Step 1

Configure the inside interface (Gi0/1) of the device to be assigned to Sales virtual router.

1. Choose Devices > Device Management, click the device name, and click Interfaces.

2. Edit the Gi0/1 interface.

   • Name—For this example, VR-Sales.

   • Select the Enabled checkbox.

   • In IPV4, for IP Type, choose Use Static IP.

   • IP Address—Enter 10.30.0.1/24.

3. Click Ok.

4. Click Save.

Step 2

Configure the inside interface (Gi0/2) of the device to be assigned to Warehouse virtual router.

1. Choose Devices > Device Management, click the device name, and click Interfaces.

2. Edit the Gi0/2 interface.

   • Name—For this example, VR-Warehouse.

   • Select the Enabled checkbox.

   • In IPV4, for IP Type, choose Use Static IP.

   • IP Address—Leave it blank. The system does not allow you to configure interfaces with same IP address (10.30.0.1/24), as you are yet to create user-defined virtual routers.

3. Click Ok.

4. Click Save.

Step 3

Create Sales and Warehouse virtual routers and assign their interfaces.

1. Choose Devices > Device Management, and edit the Firewall Threat Defense device.

2. Choose Routing > Manage Virtual Routers.

3. Click Add Virtual Router and create Sales.

4. Click Add Virtual Router and create Warehouse.

5. Select Sales from virtual router drop-down, in Virtual Router Properties, add VR-Sales as Selected Interface and save.

6. Select Warehouse from virtual router drop-down, in Virtual Router Properties, add VR-Warehouse as Selected Interface and save.

Step 4

Revisit the VR-Warehouse interface configuration.

1. Choose Devices > Device Management, click the device name, and click Interfaces.

2. Click Edit against VR-Warehouse interface. Specify the IP Address as 10.30.0.1/24. The system now allows you to configure with same IP address of VR-Sales, because the interfaces are seperately assigned to two different virtual routers.

3. Click Ok.

4. Click Save.

Step 5

Create network objects for the warehouse server—10.50.0.0/24, and for the warehouse gateway— 10.40.0.2/30.

1. Choose Objects > Object Management.

2. Choose Add Network > Add Object.

   • Name—For this example, Warehouse-Server.

   • Network—Click Network and enter 10.50.0.0/24.

3. Click Save.

4. Choose Add Network > Add Object.

   • Name—For this example, Warehouse-Gateway.

   • Network—Click Host and enter 10.40.0.2.

5. Click Save.

Step 6

Define the route leak in Sales that points to the VR-Warehouse interface.

1. Choose Devices > Device Management, and edit the Firewall Threat Defense device.

2. Choose Routing.

3. Choose Sales virtual router from the drop-down, and then click Static Route.

4. Click Add Route. In Add Static Route Configuration, specify the following:

   • Interface—Select VR-Warehouse.

   • Network—Select the Warehouse-Server object.

   • Gateway—Leave it blank. When leaking a route into another virtual router, do not select the gateway.

     

5. Click Ok.

6. Click Save.

Step 7

In the Warehouse virtual router, define the route that points to the Warehouse Router 2 gateway.

1. Choose Warehouse virtual router from the drop-down, and then click Static Route.

2. Click Add Route. In Add Static Route Configuration, specify the following:

   • Interface—Select VR-Warehouse.

   • Network—Select the Warehouse-Server object.

   • Gateway—Select the Warehouse-Gateway object.

     

3. Click Ok.

4. Click Save.

Step 8

Configure access control rule that allows access to the warehouse server. For creating the access control rule, you need to create security zones. Use Objects > Object Management > Interface. Choose Add > Security Zone and create security zones for VR-Sales and VR-Warehouse; for Warehouse-Server network object, create a Warehouse-Server interface group (Choose Add > Interface Group).

Step 9

Choose Policies > Access Control heading > Access Control and configure an access control rule to allow traffic from the source interfaces in the Sales virtual router to the destination interfaces in the Warehouse virtual router for the destination Warehouse-Server network object.

For example, if the interfaces in Sales are in the Sales-Zone security zone, and those in Warehouse are in the Warehouse-Zone security zone, the access control rule would look similar to this:

Step 1

Configure route leak from Global virtual router to the user-defined VR1:

1. Choose Devices > Device Management, and edit the Firewall Threat Defense device.

2. Click Routing. By default, the Global routing properties page appears.

3. Click Static Route.

4. Click Add Route. In Add Static Route Configuration, specify the following:

   • Interface—Select the VR1 inside interface.

   • Network—Select the VR1 virtual router network object. You can create one using the Add Object option.

   • Gateway—Leave it blank. When leaking a route into another virtual router, does not select the gateway.

     

   The route leak allows Secure Client assigned IP addresses in the VPN pool to access the 192.168.1.0/24 network in the VR1 virtual router.

5. Click Ok.

Step 2

Configure the route leak from VR1 to the Global virtual router:

1. Choose Devices > Device Management, and edit the Firewall Threat Defense device.

2. Click Routing and from the drop-down, select VR1.

3. Click Static Route.

4. Click Add Route. In Add Static Route Configuration, specify the following:

   • Interface—Select the outside interface of the global router.

   • Network—Select the global virtual router network object.

   • Gateway—Leave it blank. When leaking a route into another virtual router, does not select the gateway.

     

   The configured static route allows endpoints on the 192.168.1.0/24 network (VR1) to initiate connections to Secure Client assigned IP addresses in the VPN pool.

5. Click Ok.

Step 1

Configure route leak from the Global virtual router to the user-defined VR1:

1. Choose Devices > Device Management, and edit the Firewall Threat Defense device.

2. Click Routing. By default, the Global routing properties page appears.

3. Click Static Route.

4. Click Add Route. In Add Static Route Configuration, specify the following:

   • Interface—Select the VR1 inside interface.

   • Network—Select the VR1 virtual router network object. You can create one using the Add Object option.

   • Gateway—Leave it blank. When leaking a route into another virtual router, do not select the gateway.

     

   The route leak allows endpoints protected by the external (remote) end of the site-to-site VPN to access the 192.168.1.0/24 network in the VR1 virtual router.

5. Click Ok.

Step 2

Configure the route leak from VR1 to the Global virtual router:

1. Choose Devices > Device Management, and edit the Firewall Threat Defense device.

2. Click Routing and from the drop-down, select VR1.

3. Click Static Route.

4. Click Add Route. In Add Static Route Configuration, specify the following:

   • Interface—Select the outside interface of the global router.

   • Network—Select the global virtual router network object.

   • Gateway—Leave it blank. When leaking a route into another virtual router, do not select the gateway.

     

   This static route allows endpoints on the 192.168.1.0/24 network (VR1) to initiate connections that will traverse the site-to-site VPN tunnel. For this example, the remote endpoint that is protecting the 172.16.20.0/24 network.

5. Click Ok.

Step 3

Add the 192.168.1.0/24 network to the site-to-site VPN connection profile:

1. Choose Devices > VPN > Site to Site, and edit the VPN Topology.

2. In Endpoints, edit Node A endpoint.

3. In Edit Endpoint, in the Protected Networks field, click Add New Network Object.

4. Add the VR1 network object with 192.168.1.0 network:

   

5. Click Ok and save the configuration.

Step 1

Configure a dynamic VTI interface on the hub.

1. Choose Devices > Device Management and edit the threat defense device.

2. Choose Add Interfaces > Virtual Tunnel Interface.

3. Select the Tunnel Type as Dynamic.

4. Specify the interface name as DVTI1 and configure all the parameters for the dynamic VTI.

5. Click Save

6. Repeat steps 1a - e to configure the second dynamic VTI on the hub, DVTI2.

Step 2

Configure static VTI on spoke 1.

1. Choose Devices > Device Management and edit the threat defense device.

2. Select Add Interfaces > Virtual Tunnel Interface.

3. Select the Tunnel Type as Static.

4. Specify the interface name as SVTI spoke-1 and configure all the parameters for the static VTI.

5. Click Save

6. Repeat steps 2a - e to configure the static VTI on spoke 2: SVTI spoke-2.

Step 3

Configure a route-based site-to-site VPN between hub and SVTI spoke 1.

1. Choose Devices > VPN > Site to Site and click + Site To Site VPN.

2. Enter a name for the VPN topology in the Topology Name field.

3. Choose Route Based (VTI) and select Hub and Spoke as the network topology.

4. Click the Endpoints tab.

5. Configure the hub and the spoke (DVTI1 and SVTI spoke-1) and their routing policies.

6. Configure the IKE, IPsec, and Advanced options for the VPN, if required.

7. Click Save.

8. Repeat steps 3a - g to configure the second route-based site-to-site VPN topology between hub (DVTI2) and SVTI spoke 2.

Step 4

Configure the two virtual routers.

1. Choose Devices > Device Management and edit the threat defense device.

2. Click Routing.

3. Click Manage Virtual Routers.

4. Click Add Virtual Router.

   Specify the name as VRF green and provide a description for the virtual router.

5. Repeat steps 4a - d to configure VRF red.

Step 5

Assign all the interfaces to the virtual routers.

1. From the drop-down list, select the virtual router.

2. In the Virtual Router Properties page, select the interfaces listed under the Available Interfaces box.

   Assign the dynamic VTI interface along with the other interfaces.

3. Click Add.

Step 6

Repeat steps 5a - c for VRF red.

Step 7

Configure the routing policy for the virtual router.

1. From the drop-down list, select the virtual router.

2. Click Static Route or one of the dynamic routing protocols.

3. Configure the routing parameters.

4. Click Save.

Step 1

Create the NAT rule to handle traffic from Host A to Host B. Choose Devices > NAT.

Step 2

Click New Policy.

Step 3

Enter a NAT policy name, and select the Firewall Threat Defense device. Click Save.

Step 4

In the NAT page, click Add Rule and define the following:

firepower(config-service-object-group)# show nat detail
Manual NAT Policies (Section 1)
1 (2001) to (3001) source static vrg-inside VRG-MAPPED-HOST destination static VRB-MAPPED-HOST vrb-inside
translate_hits = 0, untranslate_hits = 0
Source - Origin: 10.1.1.1/24, Translated: 20.1.1.1/24
Destination - Origin: 30.1.1.1/24, Translated: 10.1.1.1/24

Step 5

Click Ok.

Step 6

Click Save.

The NAT rule looks like this:

When you deploy the configuration, a warning message appears:

Step 1

Choose Devices > Device Management. Edit the required device.

Step 2

In Interfaces, choose Add Interfaces > Bridge Group Interface.

1. Enter the following details for BVI-G:

   • Name—For this example, BVI-G.

   • Bridge Group ID—For this example, 1.

   • Available Interface—Select the interfaces.

   • In IPV4, for IP Type, choose Use Static IP.

   • IP Address—Enter 10.10.10.5/24.

   

2. Click Ok.

3. Click Save.

1. Enter the following details for BVI-B:

   • Name—For this example, BVI-B.

   • Bridge Group ID—For this example, 2.

   • Available Interface—Select the sub interfaces.

   • In IPV4, for IP Type, choose Use Static IP.

   • IP Address—Leave this field empty as the system does not allow two interfaces to have overlapping IP address. You can revisit the Bridge Group and provide the same IP address after aligning it under a virtual router.

   

2. Click Ok.

3. Click Save.

Step 3

Create virtual router, say VRG, and select BVI-G as its network:

1. Choose Devices > Device Management.

2. Edit the device, and choose Routing > Manage Virtual Routers.

3. Click Add Virtual Router. Enter a name for the virtual router and click Ok.

4. In Virtual Routing Properties, select BVI-G and click Add.

   

5. Click Save.

Step 4

Create virtual router, say VRB, and select BVI-B as its network:

1. Choose Devices > Device Management.

2. Edit the device, and choose Routing > Manage Virtual Routers.

3. Click Add Virtual Router. Enter a name for the virtual router and click Ok.

4. In Virtual Routing Properties, select BVI-B and click Add.

   

5. Click Save.

Step 5

Revisit the BVI-B configuration:

1. Choose Devices > Device Management, edit the device and click Interfaces.

2. Click Edit against BVI-B interface. Specify the IP Address as 10.10.10.5/24. The system now allows you to configure with same IP address of BVI-G, because the interfaces are seperately assigned to two different virtual routers.

3. Click Ok.

4. Click Save.

Step 1

Configure the inside interface of the device for VRG:

1. Choose Devices > Device Management, click the device name, and then click Interfaces.

2. Edit the interfaces that you want to assign to VRG:

   • Name—For this example, VRG-inside.

   • Select the Enabled checkbox.

   • In IPV4, for IP Type, choose Use Static IP.

   • IP Address—Enter 192.168.1.1/24.

3. Click Ok.

4. Click Save.

Step 2

Configure the inside interface of the device for VRB:

1. Choose Devices > Device Management > Interfaces.

2. Edit the interfaces that you want to assign to VRB:

   • Name—For this example, VRB-inside.

   • Select the Enabled checkbox.

   • In IPV4, for IP Type, choose Use Static IP.

   • IP Address—Leave it blank. The system doesn't allow you to configure interfaces with same IP address, as you're yet to create user-defined virtual routers.

3. Click Ok.

4. Click Save.

Step 3

Configure VRG and the static default route leak to the inside interface of the Global router for the VRG users to access the common server 172.16.10.1:

1. Choose Devices > Device Management, and edit the Firewall Threat Defense device.

2. Choose Routing > Manage Virtual Routers. Click Add Virtual Router and create VRG.

3. For VRG, in Virtual Router Properties, assign VRG-inside and save.

   

4. Click Static Route.

5. Click Add Route. In Add Static Route Configuration, specify the following:

   • Interface—Select the inside interface of the global router.

   • Network—Select the any-ipv4 object.

   • Gateway—Leave it blank. When leaking a route into another virtual router, do not select a gateway.

6. Click Ok.

7. Click Save.

Step 4

Configure VRB and the static default route leak to the inside interface of the Global router for the VRB users to access the shared server 172.16.10.x:

1. Choose Devices > Device Management, and edit the Firewall Threat Defense device.

2. Choose Routing > Manage Virtual Routers. Click Add Virtual Router and create VRB.

3. For VRB, in Virtual Router Properties, assign VRB-inside and save.

   

4. Click Static Route.

5. Click Add Route. In Add Static Route Configuration, specify the following:

   • Interface—Select the inside interface of the global router.

   • Network—Select the any-ipv4 object.

   • Gateway—Leave it blank. When leaking a route into another virtual router, do not select a gateway.

6. Click Ok.

7. Click Save.

Step 5

Revisit the VRB-inside interface configuration:

1. Choose Devices > Device Management, click the device name, and then click Interfaces.

2. Click Edit against VRB-inside interface. Specify the IP Address as 192.168.1.1/24. The system now allows you to configure with the same IP address as that of VRG-inside, because the interfaces are seperately assigned to two different virtual routers.

3. Click Ok.

4. Click Save.

Step 6

Add NAT rules for the source objects VRG and VRB. Click Devices > NAT.

Step 7

Click New Policy.

Step 8

Enter a NAT policy name, and select the Firewall Threat Defense device. Click Save.

Step 9

In the NAT page, click Add Rule and define the following source NAT for VRG:

Step 10

Click Ok.

Step 11

In the NAT page, click Add Rule and define the following source NAT for VRB:

Step 12

Click Save.

The NAT rule looks like this:

Step 13

Add the two unique AD servers in Firewall Management Center one for each VRG and VRB users—choose System > Integration > Realms.

Step 14

Click New Realm and complete the fields. For detailed information on the fields, see Realm fields.

Step 15

For controlling the access from VRG and VRB users, define 2 Active Directories, see Realm directory and synchronize fieldssee Create an LDAP realm or an Active Directory realm and realm directory

Step 16

Add ISE in Firewall Management Center—choose System > Integration > Identity Sources.

Step 17

Click Identity Services Engine and complete the fields. For detailed information on the fields, see Configure ISE/ISE-PIC for user control using a realm.

Step 18

Create Identity policy, rules, and then define access control policy for controlling access of overlapping users from VRG and VRB.

Step 1

Configure VR-W to export its routes tagging them with a route target to VR-S:

1. Choose Devices > Device Management, edit device, and then click the Routing tab.

2. From the virtual router drop-down, select VR-W. Then click BGP > IPv4 > Route Import/Export.

3. To leak the VR-W routes to VR-S, tag the routes with a route target, so that the VR-W routes are exported to its BGP table with the route target marked on them. In the Route Targets Export field, enter a value, say, 200:200. Click Add:

   

4. From the virtual router drop-down, select VR-S. Then click BGP > IPv4 > Route Import/Export.

5. To receive the leaked routes from VR-W, configure the Import Route Target to import the VR-W routes that are marked with the route target from the (peer or redistributed) BGP table. In the Route Targets Import field, enter the same route target value that you had configured for VR-W, 200:200. Click Add.

   

Step 2

Configure VR-W to export its routes to the Global virtual router:

1. You need to create a route map that would allow the VR-W routes to be exported to the Global routing table. Choose Objects > Object Management > Route Map.

2. Click Add Route Map, give a name, say Export-to-Global, and then click Add.

3. Specify a Sequence Number, say 1, and then choose Allow from the Redistribution drop-down list:

   

4. Click Save.

   In this example, all the VR-W routes are leaked to the Global routing table. Hence, no match criteria is configured for the route map.

5. Navigate to the Routing tab of the device, and select VR-W. Click BGP > IPv4 > Route Import/Export.

6. From the Global Virtual Router Export Route Map drop-down list, choose Export-to-Global:

   

Step 3

To leak only the Outside1 routes of VR-S to VR-W:

1. From the virtual router drop-down, select VR-S and then click BGP > IPv4 > Route Import/Export.

2. To leak the VR-S routes to VR-W, tag the routes with a route target, so that the VR-S routes are exported to its BGP table with the route target marked on them. In the Route Targets Export field, enter a value, say, 100:100. Click Add.

3. From the virtual router drop-down, select VR-W, and choose BGP > IPv4 > Route Import/Export. To receive the leaked routes from VR-S, configure the Import Route Target to import the VR-S routes that are marked with the route target from the (peer or redistributed) BGP table. In the Route Targets Import field, enter the VR-S route target value, 100:100. Click Add.

4. Now, you need to conditionalize that only the Outside1 routes of VR-S to be leaked to VR-W. Choose Objects > Object Management > Prefix Lists > IPv4 Prefix List. Click Add IPv4 Prefix List, give a name, say VRS-Outside1-Only, and then click Add.

5. Specify a Sequence Number, say 1, and then choose Allow from the Redistribution drop-down list. Enter the IP Address (first two octets) of the VR-S Outside1 interface and then click Save.

6. Create a route map with the match clause with the prefix list. Click Route Map. Click Add Route Map, give a name, say Import-from-VRS, and then click Add.

7. Specify a Sequence Number, say 1, and then choose Allow from the Redistribution drop-down list.

8. In the Match Clause tab, click IPv4. Under Address tab, click Prefix List. Under Available IPv4 Prefix List, select VRS-Outside1-Only, and then click Add.

9. Navigate to the Routing tab of the device, and select VR-W. Click BGP > IPv4 > Route Import/Export. From the Global Virtual Router Import Route Map drop-down list, choose Import-from-VRS:

   

Step 4

Configure VR-S to import the Outside routes of Global virtual router:

1. Choose Objects > Object Management > Prefix Lists > IPv4 Prefix List.

2. Click Add IPv4 Prefix List, give a name, say Global-Outside-Only, and then click Add. Specify a Sequence Number, say 1, and then choose Allow from the Redistribution drop-down list.

3. Enter the IP Address (first two octets) of the Global Outside interface:

   

   Then click Save.

4. Click Route Map. Click Add Route Map, give a name, say Import-from-Global, and then click Add.

5. Specify a Sequence Number, say 1, and then choose Allow from the Redistribution drop-down list.

6. In the Match Clause tab, click IPv4. Under Address tab, click Prefix List.

7. Under Available IPv4 Prefix List, select Global-Outside-Only, and then click Add:

   

   Then click Save.

8. Navigate to the Routing tab of the device, and select VR-S. Click BGP > IPv4 > Route Import/Export.

9. From the Global Virtual Router Import Route Map drop-down list, choose Import-from-Global:

   

Step 5

Save and Deploy.