topic Re: Cisco ASA module FirePOWER enable bypass rules interfaces (IDS) in Network Security

Cisco ASA module FirePOWER enable bypass rules interfaces (IDS)

Alex Ribas — Tue, 20 Jul 2021 12:27:30 GMT

Hi All

I was wondering if someone enables and uses the FirePOWER module Cisco ASA without FMC.

I didn't find documentation clearly about it.

Any help is welcome.

Cheers

Alex

Re: Cisco ASA module FirePOWER enable bypass rules interfaces (IDS)

Chakshu Piplani — Tue, 20 Jul 2021 16:18:17 GMT

You question isn't that clear but you can manage Firepower services using ASDM

https://www.cisco.com/c/en/us/support/docs/security/adaptive-security-device-manager/200889-Using-ASDM-to-manage-a-FirePOWER-module.html

Hope this helps

Chakshu

Do rate helpful posts!

Re: Cisco ASA module FirePOWER enable bypass rules interfaces (IDS)

Alex Ribas — Tue, 20 Jul 2021 18:14:29 GMT

Thank you

But if we have inside and outside interface for example:

Can we enable just for check traffic in interfaces?

Thank you a lot.

Cheers

Alex

Re: Cisco ASA module FirePOWER enable bypass rules interfaces (IDS)

Marvin Rhoads — Tue, 20 Jul 2021 18:34:03 GMT

The Firepower service module ("sfr") is referenced in the global_policy policy-map. As such, the ASA sends traffic to the sfr module based on a matched class-map ACL.

So whatever traffic matches the ACL (often "ip any any") is sent to Firepower for inspection. Not just traffic on one interface or another.

Re: Cisco ASA module FirePOWER enable bypass rules interfaces (IDS)

Alex Ribas — Tue, 20 Jul 2021 19:20:32 GMT

Hi Marvin

I understood but I was wondering if we can enable IPS (by pass) in each Security zone Interfaces like this in atthached.

Thank you

Alex

Re: Cisco ASA module FirePOWER enable bypass rules interfaces (IDS)

Alex Ribas — Tue, 20 Jul 2021 19:33:33 GMT

I understood but I was wondering if we can enable IPS (by pass) in each Security zone Interfaces like this below

Thank you

Alex

Re: Cisco ASA module FirePOWER enable bypass rules interfaces (IDS)

Marvin Rhoads — Wed, 21 Jul 2021 02:58:54 GMT

If you migrated to FTD you could do a prefilter rule to trust those zones and thus bypass Snort (Firepower) altogether.

In an ASA with Firepower service module I believe you would have to craft the ACL used to select the traffic inspected by Firepower to not include the subnets in the zones where you don't want inspection.