ASA Firepower with Automatic Application Bypass (AAB) and Intelligent Application Bypass (IAB)

u.drechsel — Tue, 06 Dec 2016 14:53:09 GMT

Hi all,

I'm using ASA5585-X SSP40 (version 9.4.(2)6 ) with Firepower 6.0.1.2. Because of performance issues I've activated AAB for testing purposes. In the documentation I found:

"If detection is bypassed, the device generates a health monitoring alert."

I also activated IAB in test mode for application category "very low risks"

I want to know, how often these events occures and what kind of information it contains. Does anybody know, how I can identify these events in the Health monitor or via CLI?

Thank you,

Sincerely,

Uwe

Hello,

Claudiu Cismaru — Mon, 09 Jan 2017 10:17:59 GMT

Hello,

When AAB triggers you'll get an event in Health Events. It will trigger once a packet will take more than configured threshold until gets out on the output interface.

IAB should be configured for large flows identified (like SMB traffic, large downloads over non HTTPS flows).

topic ASA Firepower with Automatic Application Bypass (AAB) and Intelligent Application Bypass (IAB) in Network Security

ASA Firepower with Automatic Application Bypass (AAB) and Intelligent Application Bypass (IAB)

Hello,