topic Re: Firepower Traffic Blocked with Default Action but same permitted o in Network Security

Firepower Traffic Blocked with Default Action but same permitted other

Danny Dulin — Wed, 07 Aug 2024 20:51:03 GMT

We are experiencing an issue where a packet is blocked by a Default Action but previous and subsequent traffic between the same src and dst is permitted. The blocked traffic event has no Ingress or Egress interface.

The traffic has ACP that permits Any VLAN to ANY network on 443.

NOTE: There are other similar events on different ports.

Re: Firepower Traffic Blocked with Default Action but same permitted o

MHM Cisco World — Wed, 07 Aug 2024 21:02:01 GMT

Can you more elaborate

MHM

Re: Firepower Traffic Blocked with Default Action but same permitted o

Danny Dulin — Thu, 08 Aug 2024 12:53:18 GMT

Here's an example.

I have an ACP that permits Any -> Any Port 443.

I see connection events permitting 10.5.5.5 -> 192.168.5.155 port 443

I also see connection events blocking 10.5.5.5 -> 192.168.5.155 port 443

The blocked connection events have no ingress or egress data.

The blocked event identifies "Default Action" as the ACP rule the FW rule that decided the action.

There's no reason for the block other than the device could not find a rule to match the traffic, but the reality is there is a rule.

Re: Firepower Traffic Blocked with Default Action but same permitted o

MHM Cisco World — Fri, 09 Aug 2024 09:53:12 GMT

I send to you PM please check it

MHM