topic FMC's Security Intelligence and Access Control in Network Security

FMC's Security Intelligence and Access Control

Will Kirk — Tue, 10 Dec 2024 16:07:02 GMT

Howdy y'all,

We've recently installed FPR1140's, managed by CDO, and we make use of blocking certain Talos' Categories (Malware, Malicious, Phishing, etc).

I understand that the Security Intelligence process is before the Access Rules, and that SI can block a URL or network list, while the Access Rules only have access to the URL list.

But is there a difference, for example, between the "Malicious" category found on SI, vs the "Malicious" category found on the Access Rules?

What is best-practice for blocking networks/URL's with these 2 options?

Thanks in advance.

Re: FMC's Security Intelligence and Access Control

MHM Cisco World — Tue, 10 Dec 2024 17:47:41 GMT

Access Rules, and that SI can block a URL or network list, while the Access Rules only have access to the URL list. <<- this not correct

Now regarding ACP URL and SI URL.

SI url for all bad url' like adult' gambling..etc.

ACP URL is good known url like Facebook' goolge..etc..

So for Bad we know we need to deny it' but what about good known url?

Will' assume your company want to deny all social media but allow only Facebook' here we use ACP URL.

Thanks

MHM