topic Re: I'd look under "Analysis, in Network Security

Where to check if sourcefire is blocking IP

mahesh18 — Tue, 12 Mar 2019 12:39:57 GMT

Hi Everyone,

In our environment we are frequently asked to check specifc IP addresses to confirm if sourcefire is allowing the connection or not.

Need to confirm if Sourcefire DC is blocking any IP address which is the best place to check?

Under connection events?

or Security Intelligence events?

Regards

MAhesh

I'd look under "Analysis,

Marvin Rhoads — Mon, 20 Apr 2015 16:28:03 GMT

I'd look under "Analysis, Search" make sure you specify a relevant time period for your search.

Many thanks Marvin

mahesh18 — Mon, 20 Apr 2015 17:44:53 GMT

Many thanks Marvin

Regards

Mahesh

Re: Where to check if sourcefire is blocking IP

anousakisioannis — Thu, 29 Aug 2019 13:03:02 GMT

Hello,

I see the below results in sh service-policy sfr command

Global policy:
Service-policy: global_policy
Class-map: FIREPOWER-Class
SFR: card status Up, mode fail-open
packet input 2718995, packet output 2719028, drop 357, reset-drop 40

Where can i see the 357 drops in FMC?

Thank you

Re: I'd look under "Analysis,

Florin Barhala — Thu, 12 Sep 2019 10:25:13 GMT

Hi Marvin,

Can you please bring more light over this. All is in place and "sh service-policy sfr" shows some drops.
How can we find out more about them? I went to Analysis \ Search but there're a lot of stuff there....

Re: I'd look under "Analysis,

Marvin Rhoads — Thu, 12 Sep 2019 12:05:06 GMT

I usually right click on an "Allow" event and tell the FMC to exclude all events of that type. That pares down the list quite a bit. You can save that filter as an FMC bookmark as well.

Re: I'd look under "Analysis,

Florin Barhala — Fri, 13 Sep 2019 06:32:24 GMT

I could spot a saved search named Dropped events as per the attachment - but this is a search within Intrusion Events.

What do you think?

Re: I'd look under "Analysis,

Marvin Rhoads — Fri, 13 Sep 2019 12:07:27 GMT

That's a predefined search and, as you noted, specific to Intrusion Events. I don't believe it would include drops due to Security Intelligence, URL Blacklist or other miscellaneous reasons.

I use one like this:

FMC - Connection Events NOT Allowed