# FTD is a session factory. The first packet is not the rest. Source: https://ai.techclick.in/blog_ciscoftd_session_factory Markdown: https://ai.techclick.in/blog_ciscoftd_session_factory.md Publisher: Techclick Infosec Pvt Ltd FTD session factory: LINA then Snort, first packet vs offload, packet-tracer is predicted. Official TAC 212321 + 212474. Six-question quiz. Quick answer FTD is two engines on one appliance. LINA owns the session: interface, prefilter, NAT, route, conn table. If policy requires it, LINA hands the packet to Snort . Snort returns a verdict. LINA drops or forwards. Allow usually sends every packet of the session to Snort. Trust sends a few packets, then Snort can fast-forward the rest to LINA. Prefilter Fastpath bypasses Snort; on Firepower 4100/9300 native instances the rest can leave LINA for hardware offload. packet-tracer injects a virtual packet. It is predicted. show conn flags are live. Say this out loud LINA takes the packet. Snort may return a verdict. The first packet is not the rest. packet-tracer is predicted. Live flags prove the handshake. ## 1. Why the factory matters The ticket is always the same shape. Finance cannot finish SaaS. Someone already pasted a green ALLOW. The manager wants a new access-control rule. You are one SSH hop from either closing it or making it worse. Cisco TAC 212321 and 212474 draw the same four lines: the packet enters LINA; policy may send it to Snort; Snort returns a verdict; LINA drops or forwards. If you treat FTD like a single ACL, you will “fix” the wrong plane — or you will keep sending elephant HTTPS through Snort after the factory already decided the rest can leave. Hero · two engines, one box Notice: the user never talks to Snort first. LINA takes the packet, then may hand it to Snort, then LINA forwards or drops. #### LINA ASA-derived data plane. Interfaces, routing, NAT, VPN, stateful ACL, connection table, HA role, and — on 4100/9300 native — hardware flow offload. #### Snort Inspection engine. AppID, URL, intrusion, file. Returns pass, block-list, or permit-list (fast-forward). LINA still does the drop or the forward. #### First packet Creates the flow. May sit in LINA only, or go to Snort while AppID is pending. A few early packets can pass before the L7 rule is known. #### The rest Allow usually keeps sending every packet to Snort. Trust can fast-forward to LINA. Prefilter Fastpath can offload off the box. Operator tip Dummy lab values on this page match the Techclick ciscoftd simulator: host 10.10.8.22 , dest 198.51.100.80:443 , PAT 203.0.113.20 , rule 14 Finance-SaaS , IPS Balanced Security and Connectivity . Confirm live syntax before you type on a real device. ## 2. Mental model: LINA, Snort, first packet Pre-train the hard words before the runbook. You will use them in every ticket. - LINA — the session path. Ingress interface, prefilter, NAT, route lookup, connection flags, offload. - Snort — later phase when policy requires it. AppID, intrusion policy, file policy. Attached to an Allow (or Interactive Block) rule, not to Trust or Block. - Handoff — official TAC picture: packet in LINA → optional Snort inspect → Snort verdict → LINA drop or forward. - packet-tracer — Cisco’s own words: it generates a virtual packet. Predicted path. Not the user’s handshake. - Fast-forward / PERMITLIST — Snort verdict that tells LINA “stop sending this flow to me.” Trust does this after a few packets. Allow can do it for SSL-without-SSL-policy or Intelligent Application Bypass. - Flow offload — remaining packets leave LINA for the SmartNIC. Official: native ASA/FTD on Firepower 4100 and 9300 only. Container instances do not support it. Live flag is o . - show conn flags — live state. UIO is up with data both ways. saA is an incomplete three-way handshake. N means Snort redirection. o means hardware offload. Handoff · LINA asks, Snort answers Snort never forwards. It returns a verdict. LINA is still the factory floor that drops or ships. Flow 1 · official LINA → Snort handoff Packet enters LINA, optional Snort inspect, verdict, LINA drop or forward - TAC 212321 / 212474 · four lines, one factory 1 · Ingress packet hits LINA 2 · LINA ACL · NAT · route 3 · Snort if policy requires 4 · LINA verdict drop or forward the packet Snort returns pass-packet, block-list, or permit-list (fast-forward). LINA executes it. No Snort phase = LINA already decided (L3/L4 Block, Prefilter Fastpath / trust, or cached fast-forward). Read left → right. This is Cisco’s own four-step picture, not a third-party flowchart. Do not start on standby Active/Standby means one unit passes traffic. The standby synchronizes state and waits. An empty show conn during an outage is often “you are on the wrong unit,” not “the factory has no sessions.” State HA role, then talk about first packet versus offload. ## 3. Decision flow: who sees the rest Draw this before you open FMC. The first packet creates the flow. The action decides whether packet 4 still visits Snort. Path · first packet versus offload Left belt is Allow — Snort keeps seeing the session. Right highway is Trust fast-forward or Prefilter Fastpath. The diamond is the rule action, not a feeling. Flow 2 · first packet vs the rest Rule action decides whether later packets stay on Snort or leave First packet hits LINA Which action? prefilter then ACP L3/L4 Block SYN dies in LINA Allow Most sessions: every packet goes to Snort (IPS / file) Trust Few packets to Snort then PERMITLIST → LINA Prefilter Fastpath Bypasses Snort 4100/9300: HW offload Rest stay on Snort unless SSL/IAB fast-forward Rest stay in LINA no IPS / file on this flow Rest leave LINA flag o · show flow-offload L7 Block is the trap cousin: first packets are allowed until AppID lands, then Snort block-lists. Those early packets still use Access Policy → Advanced → Intrusion Policy used before Access Control rule is determined. Read top → bottom. Diamond = action. Three floors = who sees packet 4. Source: TAC 212321 Allow / Trust / Prefilter Fastpath scenarios. ## 4. How to choose Allow, Trust, Fastpath If X then Y. Do not pick Trust because “it is faster” when you still wanted IPS. You need Action First packet The rest IPS or file / malware on the flow ACP Allow + Inspection LINA permit = redirect to Snort Usually every packet still goes to Snort SI / Identity / QoS, but no IPS or file ACP Trust A few packets to Snort PERMITLIST / fast-forward to LINA No Snort at all (L3/L4 only) Prefilter Fastpath LINA trust; Snort bypassed On 4100/9300 native: hardware offload Drop on port / subnet now Prefilter or ACP L3/L4 Block TCP SYN dies in LINA Snort never sees it Drop after AppID (HTTP, etc.) ACP L7 Block LINA permit; a few packets pass Snort block-lists once the app is known Log only, keep evaluating ACP Monitor Does not decide the flow Next non-Monitor rule (or default) does Trust versus Allow — official FMC 7.4 Both can let traffic through. Only Allow (and Interactive Block) can attach an intrusion policy and a file policy. The system does not perform deep inspection on trusted or blocked traffic. If you wanted IPS and you Trust’d the flow, Snort never ran IPS. If you wanted the connection uninspected, TAC says use Prefilter Fastpath — Trust still lets SI / Identity / a decryption rule inspect first. Do not invent offload on every box TAC 212321: flow offload is supported only on native instances of ASA and FTD, and only on Firepower 4100 and 9300. FTD container instances do not support it. On a 2100, 3100, or VM, Trust still fast-forwards to LINA — it does not grow a SmartNIC. ## 5. Runbook Side A → B → C Goal: name the action, predict the path, then prove the live session — before anyone clicks Deploy. ### Side A — Confirm the unit, then read the action Primary source: Cisco “Troubleshoot Firepower Threat Defense High Availability”; FMC 7.4 Access Control Rules for Allow / Trust; TAC 212321 for how each action is deployed to LINA versus Snort. #### State HA role SSH the management address the ticket named. Run show version then show failover . If the banner is HA : secondary (standby) , stop data-plane work. You want Primary - Active on the unit you keep typing on. - #### Name the matching action On Active: show access-control-config (and the associated prefilter). Write down whether the 5-tuple is Prefilter Fastpath, ACP Trust, ACP Allow, or Block. That one word tells you who is supposed to see packet 4. Dummy lab · ciscoftd simulator · show version > show version Cisco Fire Linux OS v7.4.2 (build LAB) Model : Cisco Secure Firewall 3120 Firepower Ext : 7.4.2 HA : secondary (standby) https://fmc.lab.example.com/#access-control/rules/14 Training mock · not live Policies → Access Control → Access Control → LAB-ACP → Add Rule ### Add Rule · Finance-SaaS Zones Networks Applications Ports Inspection Logging Name Finance-SaaS Action Allow Source Zones inside Destination Zones outside Source Networks finance-net Applications HTTPS Intrusion Policy Balanced Security and Connectivity Variable Set Default-Set File Policy None Cancel Add Exact fields from FMC 7.4 Access Control Rules: Name, Action, Zones, Networks, Applications, Inspection → Intrusion Policy, Variable Set, File Policy. Inspection attaches only on Allow / Interactive Block. Lab values only. ### Side B — Predict the path (packet-tracer) Primary source: Cisco “Use Firepower Threat Defense Captures and Packet Tracer” (Document ID 212474). Tracer generates a virtual packet. It is not the user’s packet. - #### Same 5-tuple, ingress interface On Active CLISH: packet-tracer input inside tcp 10.10.8.22 51922 198.51.100.80 443 . Or from FMC: Devices → Device Management → Troubleshoot → Advanced Troubleshooting → Packet Tracer. Read ACCESS-LIST, NAT, ROUTE-LOOKUP, FLOW-CREATION, SNORT, final Action. - #### Say the word predicted ALLOW here means “if this synthetic packet were injected, LINA and (if redirected) Snort would allow it.” Official additional information on an Allow match: This packet is sent to snort for additional processing where a verdict is reached. It does not mean the handshake finished. Next command is always live flags. Dummy lab · packet-tracer predicted allow (shape from TAC 212474) > packet-tracer input inside tcp 10.10.8.22 51922 198.51.100.80 443 Phase: ACCESS-LIST Result: ALLOW access-list CSM_FW_ACL_ advanced permit tcp host 10.10.8.22 host 198.51.100.80 eq 443 rule-id 268435461 Additional Information: This packet is sent to snort for additional processing where a verdict is reached Phase: FLOW-CREATION Result: ALLOW New flow created Phase: SNORT Result: ALLOW Firewall: allow rule, id 268435461, allow NAP id 2, IPS id 1, Verdict PASS Snort Verdict: (pass-packet) allow this packet Result: input-interface: inside output-interface: outside Action: allow https://fmc.lab.example.com/#devices/ftd-lab-01/advanced-troubleshooting Training mock · not live Devices → Device Management → ftd-lab-01 → Troubleshoot → Advanced Troubleshooting → Packet Tracer ### Packet Tracer Capture w/Trace Packet Tracer Ingress Interface inside Protocol TCP Source IP 10.10.8.22 Source Port 51922 Destination IP 198.51.100.80 Destination Port 443 Clear Trace Path from TAC 212474: Devices → Device Management → Troubleshoot → Advanced Troubleshooting. Packet Tracer injects a virtual packet. Capture w/Trace walks a real one. Lab 5-tuple only. ### Side C — Prove live flags, then name offload or IPS Primary source: Threat Defense show conn command reference; TAC 212321 Trust / Allow / Fastpath verification ( show snort statistics , show flow-offload flow , Snort verdict language). - #### Read flags and bytes show conn address 10.10.8.22 . Lab HTTPS often shows flags saA , modest bytes. That is not UIO . Handshake never finished. Path or server, not a missing Allow. - #### Match flags to the factory floor UIO plus N = live, still redirected to Snort (typical Allow + IPS). UIO without N plus o = hardware offload (4100/9300 Fastpath or Trust-as-trust). Confirm with show flow-offload flow and show snort statistics (Passed Packets versus Fast-Forwarded Flows). - #### If the session is up and still dies Rule 14 is Allow with IPS: Balanced Security and Connectivity . Open FMC Policies → Access Control , edit the rule, Inspection tab, name the intrusion policy. Check intrusion events for the same 5-tuple. Do not add another Allow. Do not Trust the flow if you still wanted IPS. Dummy lab · three live endings of the same 5-tuple > show conn address 10.10.8.22 TCP outside 198.51.100.80:443 inside 10.10.8.22:51922, idle 0:00:48, bytes 2844, flags saA ! predicted allow + saA = handshake never finished TCP outside 198.51.100.80:443 inside 10.10.8.22:51922, idle 0:00:01, bytes 184422, flags UIO N1 ! Allow + IPS: N = Snort redirection still on TCP outside 198.51.100.80:443 inside 10.10.8.22:51922, idle 0:00:00, bytes 949584, flags UIOo ! 4100/9300 native offload: o present, N absent ## 6. Runtime path of one HTTPS flow After go-live the user does not care about your tracer. The live packet does this. Proof · predicted then live Close the ticket only when predicted tracer and live flags tell the same story — or you can name why they do not. - SYN hits inside . LINA checks HA role (Active only), interface, existing conn, then prefilter. - If a Prefilter Fastpath matches, LINA trusts the flow. Snort is bypassed. On 4100/9300 native, later packets can offload to the SmartNIC. - Otherwise Security Intelligence, identity, and (if configured) decryption run before the first-match ACP rule. - Rule 14 Allow matches finance-net + HTTPS. LINA NATs to 203.0.113.20 and routes via 198.51.100.1 . Because the action is Allow with an intrusion policy, LINA hands packets to Snort. Snort returns permit or drop. LINA executes it. - If the matching action had been Trust, Snort would inspect a few packets, then return PERMITLIST — fast-forward this flow — and LINA would keep the rest. - Flags move saA → UIO only if the three-way handshake completes. Resets after UIO on an Allow + IPS rule are a later-phase story. Do not add another Allow. Flow 3 · runtime HTTPS (lab tuple) Lab HTTPS path from 10.10.8.22 through FTD to 198.51.100.80 - 10.10.8.22 inside LINA NAT + route Rule 14 Allow Finance-SaaS Snort IPS Balanced 198.51.100.80:443 via 198.51.100.1 Predicted: packet-tracer Action: allow · Snort Verdict: pass-packet Live lab: flags saA · bytes 2844 · not UIO Same 5-tuple in both tools. Tracer ALLOW + saA means predicted ≠ established. Allow + IPS is the inspected floor. Swap the action to Trust or Fastpath and packet 4 never sits in that magenta box. ## 7. Traps and proof checklist Failure Looks like Actual Proof Predicted worship packet-tracer ALLOW Virtual packet only; handshake never completed Flags not UIO Allow = pass Rule 14 green in FMC Snort dropped after Allow (IPS / file) IPS name + intrusion event Trust instead of Allow No IPS events, “inspection is on” Trust skipped deep inspection Action column; FMC: no IPS on Trust Wanted offload, used Trust + SI CPU still on Snort SI / Identity still send early packets to Snort Prefilter Fastpath if you truly want bypass Offload on the wrong platform No o flag on a 3120 / VM HW offload is 4100/9300 native only TAC 212321 note; show flow-offload L7 Block “did nothing” SYN reached the server AppID not ready; first packets must pass Capture packet 3+ shows Snort DROP Wrong unit Empty conn, “firewall is down” You are on standby show version / show failover Deploy lie FMC Success Device still on old ACP On-box show access-control-config Proof checklist before you change policy HA role written in the ticket: Active unit hostname. - Matching action named: Fastpath / Trust / Allow / Block — not “the firewall.” - packet-tracer phases pasted for the same 5-tuple (predicted, virtual). - show conn flags + bytes pasted (live). saA named as not established if that is what you have. - If Allow + reset: intrusion policy name (lab: Balanced Security and Connectivity) and one matching intrusion event — or “no event, keep looking at path.” - If you expected offload: platform is 4100/9300 native, flag o , show flow-offload flow . - FTD policy timestamp if someone already “deployed.” - No new ACP rule until isolate is done. Change-control is FMC Deploy after a named edit. Interview close FTD is a session factory. LINA takes the packet. Snort may return a verdict. I name who sees the first packet and who sees the rest. packet-tracer is predicted. show conn flags are live. I do not add an Allow to fix IPS, and I do not call Trust a hardware offload on a box that has none. ## Knowledge check Six judgment items. Map each one back to the LINA → Snort handoff, first packet versus the rest, or packet-tracer as predicted. Check, then Reset if you miss any. Q1 Official FTD packet processing (TAC 212321 / 212474) is which sequence? Snort inspects first, then LINA routes what Snort allowed Packet enters LINA; if policy requires, Snort inspects; Snort returns a verdict; LINA drops or forwards FMC inspects every packet, then pushes a verdict to both engines The standby unit inspects the first packet so Active can offload Correct: b . Re-read Mental model and Flow 1. Snort never forwards — LINA executes the verdict. Q2 packet-tracer returns Action: allow through ACL, NAT, route, and Snort. The user still cannot finish HTTPS. What is true? The live session is established — the user is wrong Snort was never in the path because tracer said allow Tracer injected a virtual packet; live flags must still prove the handshake You must add another Allow above rule 14 Correct: c . TAC 212474: Packet Tracer generates a virtual packet. Re-read Side B and Runtime. Q3 An ACP Allow matches on L3/L4 only and has an intrusion policy attached. Who sees later packets of that session? LINA deploys a permit that redirects to Snort; in most cases every packet of the session still goes to Snort Only the SYN is inspected; the rest always hardware-offload Snort never sees Allow traffic — Allow is a LINA-only shortcut Same as Prefilter Fastpath Correct: a . TAC 212321 Allow: permit in LINA means redirect to Snort; most sessions keep sending every packet. Re-read How to choose and Flow 2. Q4 ACP Trust (with SI / Identity still in play). After the three-way handshake, what does TAC show Snort doing? Every remaining packet stays on Snort for IPS The SYN is dropped in LINA and Snort never starts Trust is identical to Block with reset A few packets go to Snort, then PERMITLIST / fast-forward so LINA keeps the rest Correct: d . TAC 212321 Trust scenario: Verdict PERMITLIST, “fast forward this flow.” Re-read Flow 2 and Side C. Trust is not IPS. Q5 An ACP Block matches Application HTTP (L7). Why can the TCP SYN still leave the firewall? LINA always hardware-offloads Block rules LINA cannot know the app yet, so it permits a few packets until Snort reaches AppID, then block-lists Block on application is ignored until you add a port The standby unit forwarded the SYN Correct: b . TAC 212321 L7 Block: LINA deploys a permit; SYN and SYN/ACK get Snort PASS (pending AppID); a later packet gets DROP. Re-read Flow 2 footer and Traps. Q6 You want a cheap L3/L4 flow to completely bypass Snort on a Firepower 4110 native instance. Best action? ACP Allow with Balanced IPS attached ACP Trust while leaving Security Intelligence on — that is already a full bypass Prefilter Fastpath — Snort is bypassed; remaining packets can hardware-offload ACP Monitor, because Monitor skips the data plane Correct: c . TAC 212321: for a complete Snort bypass on 4100/9300, use Prefilter Fastpath. Trust with SI still sends early packets to Snort. Re-read How to choose . Check answers Reset ## Sources - Clarify FTD Access Control Policy Rule Actions — Document ID 212321. LINA + Snort, Allow / Trust / Block / Prefilter Fastpath, first packet versus fast-forward and hardware offload. - Use Firepower Threat Defense Captures and Packet Tracer — Document ID 212474. Four-step packet processing; tracer is a virtual packet; Capture w/Trace is a real one; FMC Devices → Device Management → Advanced Troubleshooting. - Cisco Secure Firewall Management Center Device Configuration Guide 7.4 — Access Control Rules — Allow + intrusion / file policy; Trust skips deep inspection; Monitor does not decide the flow; L7 early packets and “Intrusion Policy used before Access Control rule is determined.” - FMC 7.4 — Access Control Policies - FMC 7.4 — Prefilter Policies — Fastpath / Block / Analyze before ACP. - Cisco Secure Firewall Threat Defense Command Reference — packet-tracer , show conn , show failover . - Troubleshoot Firepower Threat Defense High Availability — Active/Standby, show failover . - FMC 7.4 — High Availability for Devices — standby does not actively pass traffic. - FMC 7.4 — Configuration Deployment Related: Blog 2 · Evidence desk · Cisco Secure Firewall hub · Dummy lab · ACP inspection order · Snort 3 IPS · HA troubleshooting --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt