topic Firepower Intrusion detection: How to disable/whitelist rule for spesific hosts? in Network Security

Firepower Intrusion detection: How to disable/whitelist rule for spesific hosts?

cisco — Tue, 12 Mar 2019 08:31:22 GMT

Hi,

I have implemented Firepower Intrusion detection on my ASA 5525-X, and how a question: One of the rules blocks traffic between 2 hosts, but I do not want this traffic to be blocked between these hosts. I want the rule to be active, but how can I prevent the rule to block traffic between these 2 hosts, while blocking traffic for other hosts that are hit by the rule?

Br,

Thor-Egil

Hello, this can be achived by

Boris Uskov — Fri, 11 Nov 2016 12:01:17 GMT

Hello, this can be achived by implementing Access control rule for those two hosts. Let's assume, you need to disable IPS Policy for traffic between 192.168.1.5 and 172.16.1.5. Inseret the new access rule above the rule with IPS policy configured. Choose the "trust" action for new rule. See the attach.

Alternatively, if you don't want to disable IPS between two hosts completely, you can create a new IPS policy with the signature which blocks traffic between two hosts currently setted to disabled state. After that create the new access rule as in the first example but with action "Allow", and implement a new IPS policy with disabled signature.

Thanks, your first solution

cisco — Fri, 11 Nov 2016 12:06:43 GMT

Thanks, your first solution will work for me.

Br,

Thor-Egil

Re: Hello, this can be achived by

zirbesma — Thu, 02 Aug 2018 12:53:10 GMT

Thanks so much. This was the solution I needed for fix a Site-Site Hyper-V replication problem.