topic Re: Firewall Device Manager - IPS rule in Network Security

Firewall Device Manager - IPS rule

mar001 — Tue, 26 Nov 2024 17:08:33 GMT

Hi guys,

Firewall Device Manager- Firepower 1010 (standalone mode, managed via https locally). I want to enable IPS on it. I created a new policy and I used one of the default IPS policies (maximum detection). I can see some hits but when I do e.g. nmap from a test device to the outside IP, does not trigger anything. The same for DoS etc.

My main question is about zones in that policy:

souce: outside

destination: any

Does that include the Firepower itself when I try to do nmap on the outside IP? Why isn't it triggering anything? I am missing sth obvious, don't I? I am more like Cisco ASA guy so this platfrorm is a bit new for me.

Re: Firewall Device Manager - IPS rule

Rob Ingram — Tue, 26 Nov 2024 17:42:55 GMT

@mar001 no, IPS is for traffic "through" the FTD, not "to" the FTD itself. Generate traffic to a device on the other side of the FTD.

Re: Firewall Device Manager - IPS rule

MHM Cisco World — Tue, 26 Nov 2024 17:55:22 GMT

https://www.youtube.com/watch?v=SutDkvAklsE <<- I think this what you looking for

MHM

Re: Firewall Device Manager - IPS rule

mar001 — Tue, 26 Nov 2024 18:05:37 GMT

Thx, I saw this video, however, this is FMC, I use Firewall Device Manager which is completely different.

Re: Firewall Device Manager - IPS rule

mar001 — Tue, 26 Nov 2024 18:07:21 GMT

Hmmm.... I cannot see if someone scans all my ports 24/7 or tries to DoS me because I do not have any ports open? Does not seem right 😉

What about ICMP DoS attack? Can someone execute it because they target my firewall and I will not get an alert?

Re: Firewall Device Manager - IPS rule

MHM Cisco World — Tue, 26 Nov 2024 18:32:53 GMT

I think FDM is not support this feature.

Open TAC ask cisco about it.

Thanks

MHM