topic Re: firepower inline normalization in Network Security

firepower inline normalization

saintlan1 — Fri, 21 Feb 2020 17:19:11 GMT

Hi,

Does any one here have experience on the firepower, the results on the intrusion events have "would have dropped" and "drop"? One IPS signature but two results drop and would have dropped.

the firepower are configured on inline mode. Any one here have the same experience? How did you manage to configure the FMC?

software version = 6.2.3 both fmc and sensor.

Thanks in advance.

Re: firepower inline normalization

Sheraz.Salim — Fri, 19 Jul 2019 17:10:06 GMT

as long as your FMC is configured to drop in line it will drop the packet and log it in the event logs.

Re: firepower inline normalization

Massimo Baschieri — Sat, 20 Jul 2019 05:44:46 GMT

It should work as you said, but I've seen cases where http and https traffic to the same host fires the same ips rule, but http traffic gets dropped and https traffic gets would have dropped.

Don't know if it depends on the host not fully discovered or what, but I've seen it.