Layer 3 Security Chain Guidelines

Configure security chain devices with Layer 3 interfaces to connect to the security chain network. These Layer 3 interfaces must have an assigned IP address and subnet mask.
Do not include devices that modify IP or TCP headers in a security chain, or be sure to disable any features that perform these functions. If the security chain returns a session to the firewall with a modified IP or TCP header, the firewall drops the session as it can no longer match it to the original pre-decrypted session.
Set the default gateways for security chain devices:
For all security chain devices except the last device in the chain, configure the default gateway to be the IP address of the next inline device.
For the last security chain device, configure the default gateway to be the firewall’s Secondary Interface IP address. This ensures that the last device returns the traffic flow to the firewall. (When you configure a decryption forwarding profile, you’ll assign one of the decryption forwarding interfaces to be the decryption broker Secondary Interface. See Objects > Decryption > Forwarding Profile > Secondary Interface, and use this interface’s IP address).
If you configured the firewall to direct sessions through the security chain bidirectionally, you must also set the default gateway of the first security chain device to be the firewall’s Primary Interface IP address (When you configure a decryption forwarding profile, you’ll assign one of the decryption forwarding interfaces to be the decryption broker Primary Interface. See Objects > Decryption > Forwarding Profile > Primary Interface, and use this interface’s IP address).
Confirm that the firewall and security chain can effectively communicate: check that the router that directs traffic between the firewall and the security chain is configured correctly, and that security chain devices are configured with static routes to appropriately direct traffic.
Security chain devices should not originate traffic to a network outside of the security chain. The firewall blocks traffic that it cannot match to the original pre-decrypted session. However, if a security chain device requires Internet access to receive updates, make sure that the device can access a separate network (for example, via the device’s management port) to facilitate those updates.
When configuring multiple security chains, it is a best practice to deploy enough security chains to provide excess capacity in the event of a security chain failure. If you enable the firewall to perform Security Chain Health Checks, and a security chain fails, the firewall continues to distribute decrypted sessions among the healthy security chains. If there are not enough healthy chains to cover the additional load, that single security chain failure could result in cascading failures as the remaining healthy security chains are oversubscribed.