topic Re: FTD Firepower Policy in Network Security

FTD Firepower Policy

Fotiosmark — Fri, 21 Feb 2020 15:30:46 GMT

Hi Team!

I am having some "trouble/issue" with setting a Policy in the FMCv.

I have manage to create a Malware policy to block Malware (Block with reset), Ok that works fine.

But at the same time when I am downloading the same Malware with HTTPS/SSL, it allows it!????!??!?

The same is with PDF files. I have created a policy to Block PDF files. Thats fine except when HTTPS is used which allow them.

Any thoughts?

Re: FTD Firepower Policy

Octavian Szolga — Wed, 14 Mar 2018 15:25:28 GMT

Hi,

Have you configured an SSL decryption policy?

If not, that's normal. You can't block what you can't see.

HTTP is clear-text, HTTPS is encrypted. Being encrypted, means (by default at least) that you don't have any data visibility from sensor's perspective.

Regards,

Octavian

Re: FTD Firepower Policy

Fotiosmark — Wed, 14 Mar 2018 15:39:06 GMT

Indeed, 🙂
Do I configure the decryption policy from Acess Control - SSL - Create Rule? Because under that, there are choices as Decrypt - Resign, Decrypt - Known Key - Block - Block with Reset