topic Re: ASA firepower module Configuration help in Network Security

ASA firepower module Configuration help

kajumblies15 — Wed, 04 Jan 2023 20:38:44 GMT

Hello,

I am working on an ASA 5555x with a firepower module. I am struggling to determine if my configurtation is working in regards to traffic making it to the module and back out to the ASA. What i am attempting to achieve here is all traffic coming in should do their normal ACL check then go to the firepower module and be ether allowed or denied based upon an access control rule in the ASA Firepower configuration section of ASDM. I would like to see traffic stop making it across if i set the access control rule on the module to block right now its not working. I have created the service policy to redirect to the module but i cannot tell if its working since the block access control policy is not working.

Thank You

Re: ASA firepower module Configuration help

Marius Gunnerud — Wed, 04 Jan 2023 21:32:08 GMT

We would need to see your ASA running configuration as well as the FirePOWER module configuration to get a better idea of what might be happening.

Re: ASA firepower module Configuration help

balaji.bandi — Wed, 04 Jan 2023 21:39:10 GMT

adding to other post

you can check :

# show service-policy sfr

Re: ASA firepower module Configuration help

kajumblies15 — Wed, 04 Jan 2023 21:53:24 GMT

I can provide the configs. When i run the show service-policy sfr it shows that there are packets going in and out. However that number doesn't increment and the outgoing packets don't go to zero when i try to set a block all rule in the module.

Re: ASA firepower module Configuration help

balaji.bandi — Wed, 04 Jan 2023 21:58:20 GMT

post the output here and config as requested for better advise.

Re: ASA firepower module Configuration help

Marius Gunnerud — Thu, 05 Jan 2023 08:49:04 GMT

Use the command "clear service-policy global" to clear the statistics for the policy map counters. This will make it easier to see the counter increase or not. If it is not increasing it possibly means that there is an issue with traffic matching in the class-map.

But as I requested earlier, it will be a little easier to understand what is happening if we see the configuration of the devices in question. Please remember to remove any sensitive information from the configuration such as usernames, passwords and public IPs before posting it to the forum.

Re: ASA firepower module Configuration help

kajumblies15 — Fri, 06 Jan 2023 14:38:47 GMT

This worked perfectly. I was able to tweak the firepower access controll rules and starting out with clear counters helped a lot and things are properly incrementing packet wise. Thank You