topic Hi , in Network Security

difference between class class-default sfr and custom match ip any any class

babiojd01 — Tue, 12 Mar 2019 13:07:24 GMT

I do not think this is a difference between using the default class class-map and creating an acl matching ip any any.

Can someone correct me because all FP documentation says create class-map sfr.

policy-map global_policy

class class-default

sfr fail-open

class-map sfr

match ip any any

policy-map global_policy

class sfr

sfr fail-open

Hi ,

Aastha Bhardwaj — Wed, 07 Sep 2016 16:29:37 GMT

Hi ,

By default :

class-map class-default
match any

So its one and the same thing , all documents show class sfr because its easy to track and you can modify and create access-lists accordingly .

Regards,

Aastha Bhardwaj

Rate if that helps!!!

I thought so. I imagine the

babiojd01 — Sun, 11 Sep 2016 13:19:21 GMT

I thought so. I imagine the access list version is useful when you want to bypass something completely from going to inspection. With the addition of pre-filters policy in FPM 6.1 i imagine you don't even need to do it that way unless its super latency sensitive.