topic Re: ASA 5500-x Firepower Configuration in Network Security

ASA 5500-x Firepower Configuration

ragulan_dms — Fri, 21 Feb 2020 14:35:31 GMT

Hi Guys,

I want to check on how to redirect the ASA traffic into firepower for IPS and AMP. Current ASA global policy match the default-inspection-traffic. I suppose this does not match all traffic. Hence wondering what the general best practice for configuring service policy in ASA to enable the ASA Firepower inspection ? Meaning to say, Should I use the current global policy as it is or should I modify the current global policy match to any any instead of default-inception-traffic ?

Regards

Ragulan

Re: ASA 5500-x Firepower Configuration

Marvin Rhoads — Sun, 29 Oct 2017 14:19:03 GMT

Best practice varies according to what you are trying to inspect.

Many organizations match all and inspect that but if you have specific traffic you need to target then yours would be different.

Also if you have, for instance, a significant amount of traffic that you trust (like IPsec going to a termination point inside your network) then you would exempt that from inspection.

Re: ASA 5500-x Firepower Configuration

johnd2310 — Mon, 30 Oct 2017 00:45:22 GMT

Hi,

You can use the global policy as follows:

-Identify the traffic that you need to send to the IPS module.

-create a class-map for access-list

-apply the class-map under the global policy-map

access-list IPS extended permit ip any any

class-map IPS-TRAFFIC-CLASS
description Traffic for IPS Processing
match access-list IPS

policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect icmp
inspect snmp
class IPS-TRAFFIC-CLASS
sfr fail-open

Thanks

John

Re: ASA 5500-x Firepower Configuration

ragulan_dms — Thu, 02 Nov 2017 01:37:19 GMT

Thanks John and Melvin. This means , for example, ftp traffic will go through both ASA inspection and firepower IPS ?

Re: ASA 5500-x Firepower Configuration

Patrick Moubarak — Thu, 02 Nov 2017 01:47:44 GMT

Yes, ASA runs its own inspect and sends a copy of the packets to the Firepower module.

Firepower runs preprocessor and other advanced security (IPS, AMP...) on the connections and instructs the ASA to drop or reset a connection if needed.

Hope that helps.