topic Re: Adding addresses to existing Network List - Firepower in Network Security

Adding addresses to existing Network List - Firepower

ziqex — Mon, 09 Mar 2020 13:48:20 GMT

Hello everyone,

I would like to add couple of addresses to existing network list.

Once I click edit on the list, I can only delete existing addresses or save the config.

I don't see the add option. Please advise.

Regards,

Daniel

Re: Adding addresses to existing Network List - Firepower

Rob Ingram — Mon, 09 Mar 2020 13:55:20 GMT

Hi,
Are you referring to Security Intelligence lists?
You just download the latest list, update it then re-upload the list and deploy.

HTH

Re: Adding addresses to existing Network List - Firepower

ziqex — Mon, 09 Mar 2020 14:30:35 GMT

Yes, I refer to Security intelligence , Network lists and feeds.

How can I download the list?

I see following options only: update feeds, add network lists and feeds delete.

Thanks

Re: Adding addresses to existing Network List - Firepower

star1 — Mon, 09 Mar 2020 15:37:42 GMT

Hello,

I think you need to do that on the Object - Object Management then find the object you need to modify and click on the pencil icon on the right hand then choose range then save the configuration and go back to policies - access control chose the object and deploy, this should sort the problem.

Re: Adding addresses to existing Network List - Firepower

Rob Ingram — Mon, 09 Mar 2020 15:52:08 GMT

You can select the pencil icon to the right of the list, which will open the window below. You can then click download, upload the list in notepad, edit and then re-upload.

If you don't see that, please upload a screenshot.

HTH

Re: Adding addresses to existing Network List - Firepower

ziqex — Mon, 09 Mar 2020 17:53:55 GMT

For the global-whitelist I only see the option as per below screenshot.

I do not know how can I add extra addresses.

However, for the block list I see the same options as you have.

Thanks

Re: Adding addresses to existing Network List - Firepower

Rob Ingram — Mon, 09 Mar 2020 18:07:01 GMT

You go to connection > events, right click the IP address and then select either Blacklist or Whitelist IP address. The IP address would then appear in the Blacklist or Whitelist you referenced.

Re: Adding addresses to existing Network List - Firepower

ziqex — Tue, 10 Mar 2020 09:11:37 GMT

What if the connection has not been ever established to those addresses.

The addresses are not shown in the events.

Regards,

Daniel

Re: Adding addresses to existing Network List - Firepower

Rob Ingram — Tue, 10 Mar 2020 09:40:20 GMT

You could just generate some traffic to the address(s), monitor in the connection events and then add to the global whitelist/blacklist.

Or just create a custom list (as per the screenshot I previously providied), that would perhaps allow you the ability to add/remove easier.

Re: Adding addresses to existing Network List - Firepower

ziqex — Tue, 10 Mar 2020 09:48:37 GMT

Perfect. I have created and uploaded new list as advised, called White_List.
Do I need to manually add it for policies etc?
If yes how can I check which policies are using the default Global-Whitelist.
Thanks for the advice.

Re: Adding addresses to existing Network List - Firepower

Rob Ingram — Tue, 10 Mar 2020 10:57:12 GMT

Once you've created the Network List, you would need to modify your Access Policy, go to the Security Intelligence tab and then select the list (add to whitelist).

E.g. - custom list called "IP_List" added to Whitelist.

You will also be able to determine whether the Policy is using the Global Whitelist/Blacklists.