topic Re: FMC policy configuration problem in Network Security

FMC policy configuration problem

wupeifeng — Wed, 18 Jul 2018 15:34:08 GMT

hello，everyone

I am confused about two FMC policy Configuration problem，

question one：

on the advance config of the access control policy , As shown in the following figure:

when I chose this option ,invoking intrusion policy on here ,is that mean intrusion policy taken into effect all traffic before access control policy handle traffic?

question two:

when FTD interface on route or transparent mode ,can this option be taken into effect ?

for example :when i chose this option, it drop traffic ,otherwise it don't.

i hope someone can answer my question,thanks

Re: FMC policy configuration problem

Raghunath Kulkarni — Thu, 26 Jul 2018 03:25:04 GMT

Hi,

Please find the answers inline to the questions.

A1: The option of intrusion policy before the access control policy is determined will be applicable for all the traffic that is coming to the device. If any of the incoming traffic matches the intrusion policy associated under this option it will be dropped. Else it would go to access control policy and take action based on rule match.

A2: For any traffic that matches the intrusion policy unless the action "drop when inline" is not selected, the traffic will not be dropped. This is applicable to both routed mode as well as transparent mode.

In case if "drop when inline" is not selected, you would notice a lot of "would have dropped events"

Re: FMC policy configuration problem

wupeifeng — Fri, 27 Jul 2018 03:43:12 GMT

thanks for reply,i am clearly understood