topic Re: Is there anyway to see the content of FMC system provided policies? in Network Security

Is there anyway to see the content of FMC system provided access control policies?

SIMMN — Fri, 21 Feb 2020 16:02:57 GMT

FMC by default provide multiple Access Control and Intrusion Prevention policies. Is there a way to view the content of the system provided access control policies?

Re: Is there anyway to see the content of FMC system provided policies?

Troy Jackson — Thu, 02 Aug 2018 17:38:59 GMT

Depending on the system-provided base policy that is selected, the settings of the policy vary. To view the policy settings, click the Edit icon next to the policy and then click the Manage Base Policy link.

https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/overview_of_network_analysis_and_intrusion_policies.html

Re: Is there anyway to see the content of FMC system provided policies?

SIMMN — Thu, 02 Aug 2018 18:08:30 GMT

Thanks, but thats not what I am looking for. My bad. I clarified post.

Re: Is there anyway to see the content of FMC system provided access control policies?

Raghunath Kulkarni — Mon, 06 Aug 2018 03:34:29 GMT

The default policies technically fall under three categories:

1. Action Based Access.

2. Network Discovery.

3. Intrusion Policies.

Under Action Based we have either "Trust" or "Block" all traffic. In both the case, we are not inspecting the traffic but either allowing it or blocking it.

Under Network Discovery, we are just fingerprinting the network traffic passing through the box. We allow the traffic in the case.

Lastly, with intrusion policy, it means we would allow the traffic if it does not trigger any signatures that are enabled as part of the profile. The signatures that are enabled as part of the policy can be seen via the Policy--> Intrusion Policy.

Re: Is there anyway to see the content of FMC system provided access control policies?

SIMMN — Tue, 07 Aug 2018 14:08:31 GMT

Cool.