FTD is two engines on one appliance. LINA owns the session: interface, prefilter, NAT, route, conn table. If policy requires it, LINA hands the packet to Snort. Snort returns a verdict. LINA drops or forwards. Allow usually sends every packet of the session to Snort. Trust sends a few packets, then Snort can fast-forward the rest to LINA. Prefilter Fastpath bypasses Snort; on Firepower 4100/9300 native instances the rest can leave LINA for hardware offload. packet-tracer injects a virtual packet. It is predicted. show conn flags are live.
LINA takes the packet. Snort may return a verdict. The first packet is not the rest. packet-tracer is predicted. Live flags prove the handshake.
1. Why the factory matters
The ticket is always the same shape. Finance cannot finish SaaS. Someone already pasted a green ALLOW. The manager wants a new access-control rule. You are one SSH hop from either closing it or making it worse.
Cisco TAC 212321 and 212474 draw the same four lines: the packet enters LINA; policy may send it to Snort; Snort returns a verdict; LINA drops or forwards. If you treat FTD like a single ACL, you will “fix” the wrong plane — or you will keep sending elephant HTTPS through Snort after the factory already decided the rest can leave.
LINA
ASA-derived data plane. Interfaces, routing, NAT, VPN, stateful ACL, connection table, HA role, and — on 4100/9300 native — hardware flow offload.
Snort
Inspection engine. AppID, URL, intrusion, file. Returns pass, block-list, or permit-list (fast-forward). LINA still does the drop or the forward.
First packet
Creates the flow. May sit in LINA only, or go to Snort while AppID is pending. A few early packets can pass before the L7 rule is known.
The rest
Allow usually keeps sending every packet to Snort. Trust can fast-forward to LINA. Prefilter Fastpath can offload off the box.
Dummy lab values on this page match the Techclick ciscoftd simulator: host 10.10.8.22, dest 198.51.100.80:443, PAT 203.0.113.20, rule 14 Finance-SaaS, IPS Balanced Security and Connectivity. Confirm live syntax before you type on a real device.
2. Mental model: LINA, Snort, first packet
Pre-train the hard words before the runbook. You will use them in every ticket.
- LINA — the session path. Ingress interface, prefilter, NAT, route lookup, connection flags, offload.
- Snort — later phase when policy requires it. AppID, intrusion policy, file policy. Attached to an Allow (or Interactive Block) rule, not to Trust or Block.
- Handoff — official TAC picture: packet in LINA → optional Snort inspect → Snort verdict → LINA drop or forward.
- packet-tracer — Cisco’s own words: it generates a virtual packet. Predicted path. Not the user’s handshake.
- Fast-forward / PERMITLIST — Snort verdict that tells LINA “stop sending this flow to me.” Trust does this after a few packets. Allow can do it for SSL-without-SSL-policy or Intelligent Application Bypass.
- Flow offload — remaining packets leave LINA for the SmartNIC. Official: native ASA/FTD on Firepower 4100 and 9300 only. Container instances do not support it. Live flag is
o. - show conn flags — live state.
UIOis up with data both ways.saAis an incomplete three-way handshake.Nmeans Snort redirection.omeans hardware offload.
Read left → right. This is Cisco’s own four-step picture, not a third-party flowchart.
Active/Standby means one unit passes traffic. The standby synchronizes state and waits. An empty show conn during an outage is often “you are on the wrong unit,” not “the factory has no sessions.” State HA role, then talk about first packet versus offload.
3. Decision flow: who sees the rest
Draw this before you open FMC. The first packet creates the flow. The action decides whether packet 4 still visits Snort.
Read top → bottom. Diamond = action. Three floors = who sees packet 4. Source: TAC 212321 Allow / Trust / Prefilter Fastpath scenarios.
4. How to choose Allow, Trust, Fastpath
If X then Y. Do not pick Trust because “it is faster” when you still wanted IPS.
| You need | Action | First packet | The rest |
|---|---|---|---|
| IPS or file / malware on the flow | ACP Allow + Inspection | LINA permit = redirect to Snort | Usually every packet still goes to Snort |
| SI / Identity / QoS, but no IPS or file | ACP Trust | A few packets to Snort | PERMITLIST / fast-forward to LINA |
| No Snort at all (L3/L4 only) | Prefilter Fastpath | LINA trust; Snort bypassed | On 4100/9300 native: hardware offload |
| Drop on port / subnet now | Prefilter or ACP L3/L4 Block | TCP SYN dies in LINA | Snort never sees it |
| Drop after AppID (HTTP, etc.) | ACP L7 Block | LINA permit; a few packets pass | Snort block-lists once the app is known |
| Log only, keep evaluating | ACP Monitor | Does not decide the flow | Next non-Monitor rule (or default) does |
Both can let traffic through. Only Allow (and Interactive Block) can attach an intrusion policy and a file policy. The system does not perform deep inspection on trusted or blocked traffic. If you wanted IPS and you Trust’d the flow, Snort never ran IPS. If you wanted the connection uninspected, TAC says use Prefilter Fastpath — Trust still lets SI / Identity / a decryption rule inspect first.
TAC 212321: flow offload is supported only on native instances of ASA and FTD, and only on Firepower 4100 and 9300. FTD container instances do not support it. On a 2100, 3100, or VM, Trust still fast-forwards to LINA — it does not grow a SmartNIC.
5. Runbook Side A → B → C
Goal: name the action, predict the path, then prove the live session — before anyone clicks Deploy.
Side A — Confirm the unit, then read the action
Primary source: Cisco “Troubleshoot Firepower Threat Defense High Availability”; FMC 7.4 Access Control Rules for Allow / Trust; TAC 212321 for how each action is deployed to LINA versus Snort.
-
State HA role
SSH the management address the ticket named. Run
show versionthenshow failover. If the banner isHA : secondary (standby), stop data-plane work. You want Primary - Active on the unit you keep typing on. -
Name the matching action
On Active:
show access-control-config(and the associated prefilter). Write down whether the 5-tuple is Prefilter Fastpath, ACP Trust, ACP Allow, or Block. That one word tells you who is supposed to see packet 4.
> show version Cisco Fire Linux OS v7.4.2 (build LAB) Model : Cisco Secure Firewall 3120 Firepower Ext : 7.4.2 HA : secondary (standby)
Policies → Access Control → Access Control → LAB-ACP → Add Rule
Add Rule · Finance-SaaS
Exact fields from FMC 7.4 Access Control Rules: Name, Action, Zones, Networks, Applications, Inspection → Intrusion Policy, Variable Set, File Policy. Inspection attaches only on Allow / Interactive Block. Lab values only.
Side B — Predict the path (packet-tracer)
Primary source: Cisco “Use Firepower Threat Defense Captures and Packet Tracer” (Document ID 212474). Tracer generates a virtual packet. It is not the user’s packet.
-
Same 5-tuple, ingress interface
On Active CLISH:
packet-tracer input inside tcp 10.10.8.22 51922 198.51.100.80 443. Or from FMC: Devices → Device Management → Troubleshoot → Advanced Troubleshooting → Packet Tracer. Read ACCESS-LIST, NAT, ROUTE-LOOKUP, FLOW-CREATION, SNORT, final Action. -
Say the word predicted
ALLOW here means “if this synthetic packet were injected, LINA and (if redirected) Snort would allow it.” Official additional information on an Allow match: This packet is sent to snort for additional processing where a verdict is reached. It does not mean the handshake finished. Next command is always live flags.
> packet-tracer input inside tcp 10.10.8.22 51922 198.51.100.80 443
Phase: ACCESS-LIST
Result: ALLOW
access-list CSM_FW_ACL_ advanced permit tcp host 10.10.8.22
host 198.51.100.80 eq 443 rule-id 268435461
Additional Information:
This packet is sent to snort for additional processing where a verdict is reached
Phase: FLOW-CREATION
Result: ALLOW
New flow created
Phase: SNORT
Result: ALLOW
Firewall: allow rule, id 268435461, allow
NAP id 2, IPS id 1, Verdict PASS
Snort Verdict: (pass-packet) allow this packet
Result:
input-interface: inside output-interface: outside
Action: allow
Devices → Device Management → ftd-lab-01 → Troubleshoot → Advanced Troubleshooting → Packet Tracer
Packet Tracer
Path from TAC 212474: Devices → Device Management → Troubleshoot → Advanced Troubleshooting. Packet Tracer injects a virtual packet. Capture w/Trace walks a real one. Lab 5-tuple only.
Side C — Prove live flags, then name offload or IPS
Primary source: Threat Defense show conn command reference; TAC 212321 Trust / Allow / Fastpath verification (show snort statistics, show flow-offload flow, Snort verdict language).
-
Read flags and bytes
show conn address 10.10.8.22. Lab HTTPS often showsflags saA, modest bytes. That is notUIO. Handshake never finished. Path or server, not a missing Allow. -
Match flags to the factory floor
UIOplusN= live, still redirected to Snort (typical Allow + IPS).UIOwithoutNpluso= hardware offload (4100/9300 Fastpath or Trust-as-trust). Confirm withshow flow-offload flowandshow snort statistics(Passed Packets versus Fast-Forwarded Flows). -
If the session is up and still dies
Rule 14 is Allow with IPS: Balanced Security and Connectivity. Open FMC Policies → Access Control, edit the rule, Inspection tab, name the intrusion policy. Check intrusion events for the same 5-tuple. Do not add another Allow. Do not Trust the flow if you still wanted IPS.
> show conn address 10.10.8.22 TCP outside 198.51.100.80:443 inside 10.10.8.22:51922, idle 0:00:48, bytes 2844, flags saA ! predicted allow + saA = handshake never finished TCP outside 198.51.100.80:443 inside 10.10.8.22:51922, idle 0:00:01, bytes 184422, flags UIO N1 ! Allow + IPS: N = Snort redirection still on TCP outside 198.51.100.80:443 inside 10.10.8.22:51922, idle 0:00:00, bytes 949584, flags UIOo ! 4100/9300 native offload: o present, N absent
6. Runtime path of one HTTPS flow
After go-live the user does not care about your tracer. The live packet does this.
- SYN hits inside. LINA checks HA role (Active only), interface, existing conn, then prefilter.
- If a Prefilter Fastpath matches, LINA trusts the flow. Snort is bypassed. On 4100/9300 native, later packets can offload to the SmartNIC.
- Otherwise Security Intelligence, identity, and (if configured) decryption run before the first-match ACP rule.
- Rule 14 Allow matches
finance-net+ HTTPS. LINA NATs to203.0.113.20and routes via198.51.100.1. Because the action is Allow with an intrusion policy, LINA hands packets to Snort. Snort returns permit or drop. LINA executes it. - If the matching action had been Trust, Snort would inspect a few packets, then return PERMITLIST — fast-forward this flow — and LINA would keep the rest.
- Flags move
saA→UIOonly if the three-way handshake completes. Resets afterUIOon an Allow + IPS rule are a later-phase story. Do not add another Allow.
Allow + IPS is the inspected floor. Swap the action to Trust or Fastpath and packet 4 never sits in that magenta box.
7. Traps and proof checklist
| Failure | Looks like | Actual | Proof |
|---|---|---|---|
| Predicted worship | packet-tracer ALLOW | Virtual packet only; handshake never completed | Flags not UIO |
| Allow = pass | Rule 14 green in FMC | Snort dropped after Allow (IPS / file) | IPS name + intrusion event |
| Trust instead of Allow | No IPS events, “inspection is on” | Trust skipped deep inspection | Action column; FMC: no IPS on Trust |
| Wanted offload, used Trust + SI | CPU still on Snort | SI / Identity still send early packets to Snort | Prefilter Fastpath if you truly want bypass |
| Offload on the wrong platform | No o flag on a 3120 / VM | HW offload is 4100/9300 native only | TAC 212321 note; show flow-offload |
| L7 Block “did nothing” | SYN reached the server | AppID not ready; first packets must pass | Capture packet 3+ shows Snort DROP |
| Wrong unit | Empty conn, “firewall is down” | You are on standby | show version / show failover |
| Deploy lie | FMC Success | Device still on old ACP | On-box show access-control-config |
- HA role written in the ticket: Active unit hostname.
- Matching action named: Fastpath / Trust / Allow / Block — not “the firewall.”
- packet-tracer phases pasted for the same 5-tuple (predicted, virtual).
- show conn flags + bytes pasted (live).
saAnamed as not established if that is what you have. - If Allow + reset: intrusion policy name (lab: Balanced Security and Connectivity) and one matching intrusion event — or “no event, keep looking at path.”
- If you expected offload: platform is 4100/9300 native, flag
o,show flow-offload flow. - FTD policy timestamp if someone already “deployed.”
- No new ACP rule until isolate is done. Change-control is FMC Deploy after a named edit.
FTD is a session factory. LINA takes the packet. Snort may return a verdict. I name who sees the first packet and who sees the rest. packet-tracer is predicted. show conn flags are live. I do not add an Allow to fix IPS, and I do not call Trust a hardware offload on a box that has none.
Knowledge check
Six judgment items. Map each one back to the LINA → Snort handoff, first packet versus the rest, or packet-tracer as predicted. Check, then Reset if you miss any.
Sources
- Clarify FTD Access Control Policy Rule Actions — Document ID 212321. LINA + Snort, Allow / Trust / Block / Prefilter Fastpath, first packet versus fast-forward and hardware offload.
- Use Firepower Threat Defense Captures and Packet Tracer — Document ID 212474. Four-step packet processing; tracer is a virtual packet; Capture w/Trace is a real one; FMC Devices → Device Management → Advanced Troubleshooting.
- Cisco Secure Firewall Management Center Device Configuration Guide 7.4 — Access Control Rules — Allow + intrusion / file policy; Trust skips deep inspection; Monitor does not decide the flow; L7 early packets and “Intrusion Policy used before Access Control rule is determined.”
- FMC 7.4 — Access Control Policies
- FMC 7.4 — Prefilter Policies — Fastpath / Block / Analyze before ACP.
- Cisco Secure Firewall Threat Defense Command Reference —
packet-tracer,show conn,show failover. - Troubleshoot Firepower Threat Defense High Availability — Active/Standby,
show failover. - FMC 7.4 — High Availability for Devices — standby does not actively pass traffic.
- FMC 7.4 — Configuration Deployment
Related: Blog 2 · Evidence desk · Cisco Secure Firewall hub · Dummy lab · ACP inspection order · Snort 3 IPS · HA troubleshooting