topic Re: Cisco Firepower Management Center - negate object/network in Network Security

Cisco Firepower Management Center - negate object/network

marco.iacono — Wed, 04 Mar 2020 09:07:05 GMT

Hello together,

does anyone know if it is possible to negate an object or network in the policies?

Unfortunately I have not found anything for this.

I wanted to create a rule for Internet Access (allow any to "not RFC1918" http and https) just as an example.

Anyone have an idea or is this not possible in the FMC?

Re: Cisco Firepower Management Center - negate object/network

Marvin Rhoads — Wed, 04 Mar 2020 09:34:18 GMT

You'd have to use two entries. First entry would to block http and https to RFC 1918 network object. Second entry to permit http and https to any destination. Rules are processed from top down with rule processing stopping after first matched entry (with action other than monitor).

Re: Cisco Firepower Management Center - negate object/network

Cristian Matei — Wed, 04 Mar 2020 10:00:13 GMT

Hi,

Yes you can, by using the excluded list in your network object definition.

Regards,

Cristian Matei.

Re: Cisco Firepower Management Center - negate object/network

Marvin Rhoads — Wed, 04 Mar 2020 11:41:22 GMT

Hi Cristian,

Can you explain in more detail how to use an excluded list in a network object or object group definition? I don't see that option in my FMC running 6.5.0.2.

Re: Cisco Firepower Management Center - negate object/network

Cristian Matei — Wed, 04 Mar 2020 12:47:06 GMT

Hi,

I meant "network variables". So you define a new network variable set, you include the networks and exclude the specific ranges. You than select in your access-control policy rule the newly defined variable set, from inspection tab. Although the variable set is used for intrusion policies, in the end you attach the intrusion policy to your access-control policy rules. There are some restrictions, read carefully in the Configuration Guide, in the Managing Reusable Objects section, Variable Sets.

Regards,

Cristian Matei.

Re: Cisco Firepower Management Center - negate object/network

Marvin Rhoads — Wed, 04 Mar 2020 19:49:40 GMT

@Cristian Matei would excluding the objects from inspection by the IPS policy have the effect of blocking the connections in the associated Access Control Policy rule?

I would have thought the effect would be to exempt the excluded network(s) from IPS inspection once the associated rule action was determined - but not blocking the TCP connections in the first place.

Re: Cisco Firepower Management Center - negate object/network

Cristian Matei — Wed, 04 Mar 2020 20:43:52 GMT

Hi,

@Marvin Rhoads Yes Marvin, that is correct, i read the first questions "which says policies" and i replied, thinking IPS policies. If he needs to "negate networks" for ACP, he actually needs multiple ACP rules; if he needs to "negate networks" for IPS, he needs variable set.

Regards,

Cristian Matei.