Configure Inline Sets

Enable traffic inspection by configuring multiple inline sets using physical interfaces or EtherChannels, including optional Hardware Bypass.

Inline sets allow you to designate pairs of interfaces or EtherChannels for traffic inspection, with optional Hardware Bypass. You can configure multiple inline pairs per set.

Note	For the Firepower 4100/9300 , you configure basic interface settings in FXOS on the chassis. See Configure a Physical Interface for more information.

Before you begin

If you are using EtherChannels, add them according to Configure an EtherChannel .
We recommend that you set STP PortFast for STP-enabled switches that connect to the Firewall Threat Defense inline pair interfaces. This setting is especially useful for Hardware Bypass configurations and can reduce bypass times.

Procedure

Step 1

Select Devices > Device Management and click Edit ( edit icon ) for your Firewall Threat Defense device. The Interfaces page is selected by default.

Step 2

For each interface in the inline pair, name the interface and enable it. Also configure necessary hardware settings, ensuring they match between interfaces in the inline pair. You can configure multiple pairs of interfaces.

Click Edit () for the interface you want to edit.
In the Name field, enter a name up to 48 characters in length.
Enable the interface by checking the Enabled check box.
(Optional) Add a description in the Description field.

The description can be up to 200 characters on a single line, without carriage returns.
Leave the Mode as None .

After you add this interface to an inline set, this field will show Inline for the mode.
Do not set the security zone yet; you must set it after you create the inline set later in this procedure.
(Optional) Set the duplex and speed by clicking Hardware Configuration .
The exact speed and duplex options depend on your hardware.
- Duplex —Choose Full , Half , or Auto . Auto is the default.
- Speed —Choose 10 , 100 , 1000 , or Auto . Auto is the default.
Click OK .

Do not set any other settings for this interface.

Step 3

Click Inline Sets.

Step 4

Click Add Inline Set.

The Add Inline Set dialog box appears with General selected.

Step 5

In the Name field, enter a name for the set.

Step 6

(Optional) Change the MTU to enable jumbo frames.

For inline sets, the MTU setting is not used. However, the jumbo frame setting is relevant to inline sets; jumbo frames enable the inline interfaces to receive packets up to 9000 bytes. To enable jumbo frames, you must set the MTU of any interface on the device above 1500 bytes.

Step 7

Configure Hardware Bypass.

For the Bypass mode, choose one of the following options:
- Disabled —Set Hardware Bypass to disabled for interfaces where Hardware Bypass is supported, or use interfaces where Hardware Bypass is not supported.
- Standby —Set Hardware Bypass to the standby state on supported interfaces. Only pairs of Hardware Bypass interfaces are shown. In the standby state, the interfaces remain in normal operation until there is a trigger event.
- Bypass-Force —Manually forces the interface pair to go into a bypass state. Inline Sets shows Yes for any interface pairs that are in Bypass-Force mode.
In the Available Interfaces Pairs area, click a pair and then click Add to move it to the Selected Interface Pair area.

All possible pairings between named and enabled interfaces with the mode set to None show in this area.

Step 8

(Optional) Click Advanced to set the following optional parameters:

Tap Mode —Set to inline tap mode.

Note that you cannot enable this option and strict TCP enforcement on the same inline set.

Note	Perform Tap mode changes during a maintenance window. Changing the mode while the device is passing traffic can cause traffic disruption.

Note	Tap mode significantly impacts the Firewall Threat Defense performance, depending on the traffic.

Propagate Link State —Configure link state propagation.

Link state propagation automatically brings down the second interface in the inline interface pair when one of the interfaces in an inline set goes down. When the downed interface comes back up, the second interface automatically comes back up, also. In other words, if the link state of one interface changes, the device senses the change and updates the link state of the other interface to match it. Note that devices require up to 4 seconds to propagate link state changes. Link state propagation is especially useful in resilient network environments where routers are configured to reroute traffic automatically around network devices that are in a failure state.

Note	Do not enable Propagate Link State when using clustering.

Snort Fail Open —Enable or disable either or both of the Busy and Down options if you want new and existing traffic to pass without inspection (enabled) or drop (disabled) when the Snort process is busy or down.

By default, traffic passes without inspection when the Snort process is down, and drops when it is busy.

When the Snort process is:

Busy—It cannot process traffic fast enough because traffic buffers are full, indicating that there is more traffic than the device can handle, or because of other software resource issues.
Down—It is restarting because you deployed a configuration that requires it to restart. See Configurations that restart the snort process when deployed or activated .

When the Snort process is down and comes back up, it inspects new connections. To prevent false positives and false negatives, it does not inspect existing connections on inline, routed, or transparent interfaces because initial session information might have been lost while it was down.

Note	When Snort fails open, features that rely on the Snort process do not function. These include application control and deep inspection. The system performs only basic access control using simple, easily determined transport and network layer characteristics.

Note	The Strict TCP Enforcement option is not supported.

Step 9

Set the security zone for each interface.

Click Interfaces .
Click Edit () for the member interface.
From the Security Zone drop-down list, choose a security zone or add a new one by clicking New .

You can only set the zone after you add the interface to the inline set; adding it to an inline set configures the mode to Inline and lets you choose inline-type security zones.
Click OK .

Click Save.

What to do next

You can now go to Deploy > Deploy and deploy the policy to assigned devices. The changes are not active until you deploy them.