topic Re: ASA FirePOWER not block transfer files in Network Security

ASA FirePOWER not block transfer files

allexxf — Fri, 21 Feb 2020 15:12:22 GMT

Hi. We have asa 5508 Software Version 9.7(1)8 with installed sfr FirePOWER 6.2.0.2-51. Control and protection licenses are installed. For configure FIREPOWER use ASDM 7.8(1). We need to block files mp3 (or any others for the test). We create in ASDM file policy and rule in access control policy (screen in attachment). but the files are not blocked - they are transmitted by ftp and http (tested). And in Monitoring Real Time Eventing in connection tab column reason is empty and file tab is empty. Please, help.

Re: ASA FirePOWER not block transfer files

Marvin Rhoads — Thu, 25 Jan 2018 08:42:03 GMT

Try separating them into two rules - one for the MP3s and one for the ISOs.

Re: ASA FirePOWER not block transfer files

allexxf — Thu, 25 Jan 2018 09:48:27 GMT

Thanks for the answer. ISO added for the test - checked the transfer of the ISO files, they were also transferred. Without it, too, does not work. Now only MP3 - file transfer is not blocked

Re: ASA FirePOWER not block transfer files

allexxf — Thu, 25 Jan 2018 10:42:56 GMT

We checked the transfer MP3 through HTTP and the transfer was blocked. But FTP is not blocked.

Re: ASA FirePOWER not block transfer files

Marvin Rhoads — Thu, 25 Jan 2018 10:50:04 GMT

I'd try adding an additional rule for application protocol = ftp, action = block, file type = mp3.

It shouldn't be necessary to separate them out like that but it may get it working.

Re: ASA FirePOWER not block transfer files

allexxf — Thu, 25 Jan 2018 12:30:36 GMT

Thanks for the answer. The problem was solved. Connection FTP was on a non-standard port. With a standard port rule works

Re: ASA FirePOWER not block transfer files

Marvin Rhoads — Thu, 25 Jan 2018 14:14:51 GMT

You can define additional ports used by non-standard ftp settings. Go to Objects > Object Management > Variable Set. Edit the Default-Set, FTP_PORTS object as shown below and then re-deploy.