Block/ Allow specific traffic for specific network FMC

damori.pierce — Wed, 06 Apr 2022 19:36:52 GMT

So I'm new to FMC and I'm trying to get a grip on how things work.

I have an intrusion alert that keeps coming up.

"HI_CLIENT_DOUBLE_DECODE (119:2:1)"

Problem is, it keeps alerting on non-malicious traffic (all internal traffic).

How do I turn off this rule for a specific network? without turning it off all together?

Ex.

network is 192.168.50.48 ---> 192.168.51.30 - HI_CLIENT_DOUBLE_DECODE (119:2:1)

network is 192.168.50.48 ---> 192.168.52.30 - HI_CLIENT_DOUBLE_DECODE (119:2:1)

network is 192.168.50.48 ---> 192.168.53.30 - HI_CLIENT_DOUBLE_DECODE (119:2:1)

Re: Block/ Allow specific traffic for specific network FMC

Eric R. Jones — Wed, 06 Apr 2022 22:35:22 GMT

A shot in the dark without trying this myself.

1. Create a new object(s) without that network. Edit the current rule and replace the current object(s) with the newly created one.

My other thought is to investigate your Policies > Intrusion Policies.

I would be interested in the resolution of this.