T Techclick ← All lessons
Cisco Secure Firewall · FTD / FMC · Interactive lesson

FTD is a session factory. The first packet is not the rest.

A ticket says HTTPS is down. Someone already pasted packet-tracer Action: allow. The conn table is saA. The manager wants another Allow. The factory is two engines and one handoff: LINA takes the packet, Snort may return a verdict, and later packets may never visit Snort at all.

20 min read · L2 primary · Quiz at end · Dummy lab only

After this page you can

Quick answer

FTD is two engines on one appliance. LINA owns the session: interface, prefilter, NAT, route, conn table. If policy requires it, LINA hands the packet to Snort. Snort returns a verdict. LINA drops or forwards. Allow usually sends every packet of the session to Snort. Trust sends a few packets, then Snort can fast-forward the rest to LINA. Prefilter Fastpath bypasses Snort; on Firepower 4100/9300 native instances the rest can leave LINA for hardware offload. packet-tracer injects a virtual packet. It is predicted. show conn flags are live.

Say this out loud

LINA takes the packet. Snort may return a verdict. The first packet is not the rest. packet-tracer is predicted. Live flags prove the handshake.

1. Why the factory matters

The ticket is always the same shape. Finance cannot finish SaaS. Someone already pasted a green ALLOW. The manager wants a new access-control rule. You are one SSH hop from either closing it or making it worse.

Cisco TAC 212321 and 212474 draw the same four lines: the packet enters LINA; policy may send it to Snort; Snort returns a verdict; LINA drops or forwards. If you treat FTD like a single ACL, you will “fix” the wrong plane — or you will keep sending elephant HTTPS through Snort after the factory already decided the rest can leave.

Hero · two engines, one box
User HTTPS enters LINA first, then Snort, then the app
Notice: the user never talks to Snort first. LINA takes the packet, then may hand it to Snort, then LINA forwards or drops.

LINA

ASA-derived data plane. Interfaces, routing, NAT, VPN, stateful ACL, connection table, HA role, and — on 4100/9300 native — hardware flow offload.

Snort

Inspection engine. AppID, URL, intrusion, file. Returns pass, block-list, or permit-list (fast-forward). LINA still does the drop or the forward.

First packet

Creates the flow. May sit in LINA only, or go to Snort while AppID is pending. A few early packets can pass before the L7 rule is known.

The rest

Allow usually keeps sending every packet to Snort. Trust can fast-forward to LINA. Prefilter Fastpath can offload off the box.

Operator tip

Dummy lab values on this page match the Techclick ciscoftd simulator: host 10.10.8.22, dest 198.51.100.80:443, PAT 203.0.113.20, rule 14 Finance-SaaS, IPS Balanced Security and Connectivity. Confirm live syntax before you type on a real device.

2. Mental model: LINA, Snort, first packet

Pre-train the hard words before the runbook. You will use them in every ticket.

Handoff · LINA asks, Snort answers
LINA hands a packet to Snort and receives a verdict chip back
Snort never forwards. It returns a verdict. LINA is still the factory floor that drops or ships.
Flow 1 · official LINA → Snort handoff
TAC 212321 / 212474 · four lines, one factory 1 · Ingress packet hits LINA 2 · LINA ACL · NAT · route 3 · Snort if policy requires 4 · LINA verdict drop or forward the packet Snort returns pass-packet, block-list, or permit-list (fast-forward). LINA executes it. No Snort phase = LINA already decided (L3/L4 Block, Prefilter Fastpath / trust, or cached fast-forward).

Read left → right. This is Cisco’s own four-step picture, not a third-party flowchart.

Do not start on standby

Active/Standby means one unit passes traffic. The standby synchronizes state and waits. An empty show conn during an outage is often “you are on the wrong unit,” not “the factory has no sessions.” State HA role, then talk about first packet versus offload.

3. Decision flow: who sees the rest

Draw this before you open FMC. The first packet creates the flow. The action decides whether packet 4 still visits Snort.

Path · first packet versus offload
Diamond labeled First packet splitting inspect versus offload paths
Left belt is Allow — Snort keeps seeing the session. Right highway is Trust fast-forward or Prefilter Fastpath. The diamond is the rule action, not a feeling.
Flow 2 · first packet vs the rest
First packet hits LINA Which action? prefilter then ACP L3/L4 Block SYN dies in LINA Allow Most sessions: every packet goes to Snort (IPS / file) Trust Few packets to Snort then PERMITLIST → LINA Prefilter Fastpath Bypasses Snort 4100/9300: HW offload Rest stay on Snort unless SSL/IAB fast-forward Rest stay in LINA no IPS / file on this flow Rest leave LINA flag o · show flow-offload L7 Block is the trap cousin: first packets are allowed until AppID lands, then Snort block-lists. Those early packets still use Access Policy → Advanced → Intrusion Policy used before Access Control rule is determined.

Read top → bottom. Diamond = action. Three floors = who sees packet 4. Source: TAC 212321 Allow / Trust / Prefilter Fastpath scenarios.

4. How to choose Allow, Trust, Fastpath

If X then Y. Do not pick Trust because “it is faster” when you still wanted IPS.

You needActionFirst packetThe rest
IPS or file / malware on the flowACP Allow + InspectionLINA permit = redirect to SnortUsually every packet still goes to Snort
SI / Identity / QoS, but no IPS or fileACP TrustA few packets to SnortPERMITLIST / fast-forward to LINA
No Snort at all (L3/L4 only)Prefilter FastpathLINA trust; Snort bypassedOn 4100/9300 native: hardware offload
Drop on port / subnet nowPrefilter or ACP L3/L4 BlockTCP SYN dies in LINASnort never sees it
Drop after AppID (HTTP, etc.)ACP L7 BlockLINA permit; a few packets passSnort block-lists once the app is known
Log only, keep evaluatingACP MonitorDoes not decide the flowNext non-Monitor rule (or default) does
Trust versus Allow — official FMC 7.4

Both can let traffic through. Only Allow (and Interactive Block) can attach an intrusion policy and a file policy. The system does not perform deep inspection on trusted or blocked traffic. If you wanted IPS and you Trust’d the flow, Snort never ran IPS. If you wanted the connection uninspected, TAC says use Prefilter Fastpath — Trust still lets SI / Identity / a decryption rule inspect first.

Do not invent offload on every box

TAC 212321: flow offload is supported only on native instances of ASA and FTD, and only on Firepower 4100 and 9300. FTD container instances do not support it. On a 2100, 3100, or VM, Trust still fast-forwards to LINA — it does not grow a SmartNIC.

5. Runbook Side A → B → C

Goal: name the action, predict the path, then prove the live session — before anyone clicks Deploy.

Side A — Confirm the unit, then read the action

Primary source: Cisco “Troubleshoot Firepower Threat Defense High Availability”; FMC 7.4 Access Control Rules for Allow / Trust; TAC 212321 for how each action is deployed to LINA versus Snort.

  1. State HA role

    SSH the management address the ticket named. Run show version then show failover. If the banner is HA : secondary (standby), stop data-plane work. You want Primary - Active on the unit you keep typing on.

  2. Name the matching action

    On Active: show access-control-config (and the associated prefilter). Write down whether the 5-tuple is Prefilter Fastpath, ACP Trust, ACP Allow, or Block. That one word tells you who is supposed to see packet 4.

Dummy lab · ciscoftd simulator · show version
> show version
Cisco Fire Linux OS v7.4.2 (build LAB)
Model              : Cisco Secure Firewall 3120
Firepower Ext       : 7.4.2
HA                 : secondary (standby)
https://fmc.lab.example.com/#access-control/rules/14
Training mock · not live

Policies → Access Control → Access Control → LAB-ACP → Add Rule

Add Rule · Finance-SaaS

ZonesNetworksApplicationsPortsInspectionLogging
Finance-SaaS
Allow
inside
outside
finance-net
HTTPS
Balanced Security and Connectivity
Default-Set
None

Exact fields from FMC 7.4 Access Control Rules: Name, Action, Zones, Networks, Applications, Inspection → Intrusion Policy, Variable Set, File Policy. Inspection attaches only on Allow / Interactive Block. Lab values only.

Side B — Predict the path (packet-tracer)

Primary source: Cisco “Use Firepower Threat Defense Captures and Packet Tracer” (Document ID 212474). Tracer generates a virtual packet. It is not the user’s packet.

  1. Same 5-tuple, ingress interface

    On Active CLISH: packet-tracer input inside tcp 10.10.8.22 51922 198.51.100.80 443. Or from FMC: Devices → Device Management → Troubleshoot → Advanced Troubleshooting → Packet Tracer. Read ACCESS-LIST, NAT, ROUTE-LOOKUP, FLOW-CREATION, SNORT, final Action.

  2. Say the word predicted

    ALLOW here means “if this synthetic packet were injected, LINA and (if redirected) Snort would allow it.” Official additional information on an Allow match: This packet is sent to snort for additional processing where a verdict is reached. It does not mean the handshake finished. Next command is always live flags.

Dummy lab · packet-tracer predicted allow (shape from TAC 212474)
> packet-tracer input inside tcp 10.10.8.22 51922 198.51.100.80 443
Phase: ACCESS-LIST
Result: ALLOW
  access-list CSM_FW_ACL_ advanced permit tcp host 10.10.8.22
    host 198.51.100.80 eq 443 rule-id 268435461
  Additional Information:
   This packet is sent to snort for additional processing where a verdict is reached
Phase: FLOW-CREATION
Result: ALLOW
  New flow created
Phase: SNORT
Result: ALLOW
  Firewall: allow rule, id 268435461, allow
  NAP id 2, IPS id 1, Verdict PASS
  Snort Verdict: (pass-packet) allow this packet
Result:
input-interface: inside   output-interface: outside
Action: allow
https://fmc.lab.example.com/#devices/ftd-lab-01/advanced-troubleshooting
Training mock · not live

Devices → Device Management → ftd-lab-01 → Troubleshoot → Advanced Troubleshooting → Packet Tracer

Packet Tracer

Capture w/TracePacket Tracer
inside
TCP
10.10.8.22
51922
198.51.100.80
443

Path from TAC 212474: Devices → Device Management → Troubleshoot → Advanced Troubleshooting. Packet Tracer injects a virtual packet. Capture w/Trace walks a real one. Lab 5-tuple only.

Side C — Prove live flags, then name offload or IPS

Primary source: Threat Defense show conn command reference; TAC 212321 Trust / Allow / Fastpath verification (show snort statistics, show flow-offload flow, Snort verdict language).

  1. Read flags and bytes

    show conn address 10.10.8.22. Lab HTTPS often shows flags saA, modest bytes. That is not UIO. Handshake never finished. Path or server, not a missing Allow.

  2. Match flags to the factory floor

    UIO plus N = live, still redirected to Snort (typical Allow + IPS). UIO without N plus o = hardware offload (4100/9300 Fastpath or Trust-as-trust). Confirm with show flow-offload flow and show snort statistics (Passed Packets versus Fast-Forwarded Flows).

  3. If the session is up and still dies

    Rule 14 is Allow with IPS: Balanced Security and Connectivity. Open FMC Policies → Access Control, edit the rule, Inspection tab, name the intrusion policy. Check intrusion events for the same 5-tuple. Do not add another Allow. Do not Trust the flow if you still wanted IPS.

Dummy lab · three live endings of the same 5-tuple
> show conn address 10.10.8.22
TCP outside 198.51.100.80:443 inside 10.10.8.22:51922, idle 0:00:48, bytes 2844, flags saA
! predicted allow + saA = handshake never finished

TCP outside 198.51.100.80:443 inside 10.10.8.22:51922, idle 0:00:01, bytes 184422, flags UIO N1
! Allow + IPS: N = Snort redirection still on

TCP outside 198.51.100.80:443 inside 10.10.8.22:51922, idle 0:00:00, bytes 949584, flags UIOo
! 4100/9300 native offload: o present, N absent

6. Runtime path of one HTTPS flow

After go-live the user does not care about your tracer. The live packet does this.

Proof · predicted then live
Operations desk verifying packet-tracer and live connection flags
Close the ticket only when predicted tracer and live flags tell the same story — or you can name why they do not.
  1. SYN hits inside. LINA checks HA role (Active only), interface, existing conn, then prefilter.
  2. If a Prefilter Fastpath matches, LINA trusts the flow. Snort is bypassed. On 4100/9300 native, later packets can offload to the SmartNIC.
  3. Otherwise Security Intelligence, identity, and (if configured) decryption run before the first-match ACP rule.
  4. Rule 14 Allow matches finance-net + HTTPS. LINA NATs to 203.0.113.20 and routes via 198.51.100.1. Because the action is Allow with an intrusion policy, LINA hands packets to Snort. Snort returns permit or drop. LINA executes it.
  5. If the matching action had been Trust, Snort would inspect a few packets, then return PERMITLIST — fast-forward this flow — and LINA would keep the rest.
  6. Flags move saAUIO only if the three-way handshake completes. Resets after UIO on an Allow + IPS rule are a later-phase story. Do not add another Allow.
Flow 3 · runtime HTTPS (lab tuple)
10.10.8.22 inside LINA NAT + route Rule 14 Allow Finance-SaaS Snort IPS Balanced 198.51.100.80:443 via 198.51.100.1 Predicted: packet-tracer Action: allow · Snort Verdict: pass-packet Live lab: flags saA · bytes 2844 · not UIO Same 5-tuple in both tools. Tracer ALLOW + saA means predicted ≠ established.

Allow + IPS is the inspected floor. Swap the action to Trust or Fastpath and packet 4 never sits in that magenta box.

7. Traps and proof checklist

FailureLooks likeActualProof
Predicted worshippacket-tracer ALLOWVirtual packet only; handshake never completedFlags not UIO
Allow = passRule 14 green in FMCSnort dropped after Allow (IPS / file)IPS name + intrusion event
Trust instead of AllowNo IPS events, “inspection is on”Trust skipped deep inspectionAction column; FMC: no IPS on Trust
Wanted offload, used Trust + SICPU still on SnortSI / Identity still send early packets to SnortPrefilter Fastpath if you truly want bypass
Offload on the wrong platformNo o flag on a 3120 / VMHW offload is 4100/9300 native onlyTAC 212321 note; show flow-offload
L7 Block “did nothing”SYN reached the serverAppID not ready; first packets must passCapture packet 3+ shows Snort DROP
Wrong unitEmpty conn, “firewall is down”You are on standbyshow version / show failover
Deploy lieFMC SuccessDevice still on old ACPOn-box show access-control-config
Proof checklist before you change policy
Interview close

FTD is a session factory. LINA takes the packet. Snort may return a verdict. I name who sees the first packet and who sees the rest. packet-tracer is predicted. show conn flags are live. I do not add an Allow to fix IPS, and I do not call Trust a hardware offload on a box that has none.

Knowledge check

Six judgment items. Map each one back to the LINA → Snort handoff, first packet versus the rest, or packet-tracer as predicted. Check, then Reset if you miss any.

Q1

Official FTD packet processing (TAC 212321 / 212474) is which sequence?

Correct: b. Re-read Mental model and Flow 1. Snort never forwards — LINA executes the verdict.
Q2

packet-tracer returns Action: allow through ACL, NAT, route, and Snort. The user still cannot finish HTTPS. What is true?

Correct: c. TAC 212474: Packet Tracer generates a virtual packet. Re-read Side B and Runtime.
Q3

An ACP Allow matches on L3/L4 only and has an intrusion policy attached. Who sees later packets of that session?

Correct: a. TAC 212321 Allow: permit in LINA means redirect to Snort; most sessions keep sending every packet. Re-read How to choose and Flow 2.
Q4

ACP Trust (with SI / Identity still in play). After the three-way handshake, what does TAC show Snort doing?

Correct: d. TAC 212321 Trust scenario: Verdict PERMITLIST, “fast forward this flow.” Re-read Flow 2 and Side C. Trust is not IPS.
Q5

An ACP Block matches Application HTTP (L7). Why can the TCP SYN still leave the firewall?

Correct: b. TAC 212321 L7 Block: LINA deploys a permit; SYN and SYN/ACK get Snort PASS (pending AppID); a later packet gets DROP. Re-read Flow 2 footer and Traps.
Q6

You want a cheap L3/L4 flow to completely bypass Snort on a Firepower 4110 native instance. Best action?

Correct: c. TAC 212321: for a complete Snort bypass on 4100/9300, use Prefilter Fastpath. Trust with SI still sends early packets to Snort. Re-read How to choose.

Sources

Related: Blog 2 · Evidence desk · Cisco Secure Firewall hub · Dummy lab · ACP inspection order · Snort 3 IPS · HA troubleshooting