How to Increase Anti-Replay Window in Cisco FTD using Flex-Config

FlexConfig policy in Cisco FTD (managed by FMC) allows administrators to push custom CLI commands, similar to ASA syntax, to devices for features not supported directly via the GUI. It enables advanced configurations like PBR, specific NetFlow settings, or Application Layer Gateway (ALG) tuning.

Create the Flexconfig object

1. Navigate to objects > object management

2. Select flex config > flex config from the left sidebar

3. Click add Flexconfig object

4. Name: as per convenient like Anti_Replay_window_1024

5. Deployment: Select Everytime (to make sure the setting persists across reboots and policy deployment)

6. Type: Select Append

7. In the content section, enter the following command

Bash

Crypto ipsec security-association replay window-size 1024

8. Click Save

Assign the object to a flex config policy

1. Navigate to device > FlexConfig

2. If you have any existing policy, click the edit pencil icon, if not click the new policy, name it and select your FTD device

3. In the available flex config list on the left, search for the object you created

4. Select it and click right the right arrow to move it to the selected flex config section

5. Click save

6. Verify and deploy.

This is the global setting and once deployed, it will apply to all IPsec security association managed by this FTD.