FirePOWER Rules/Geofiltering

brandonbittinger — Sun, 10 Mar 2019 13:48:51 GMT

Hello all, i just had a few questions about Geofiltering on an ASA 5512-X with FirePOWER services managed through ASDM. I believe that I have the rules setup correctly as everything is functioning as it should. I have the rules setup so that any packet with a source or destination address that is not from the US will be blocked. Obviously there are a few cases where I will need to exempt IPs outside of the US. What is the best way to accomplish this? Currently I have added two rules, one for inbound and one for outbound, that are linked to a network objecting containing the addresses I want to whitelist. The point of this rule is to catch the traffic before it hits the block rule and specifically allow it. I also enabled the IPS filtering and file policy on this rule. If my understanding is correct the traffic I exempt should be matching this rule (which it is) and then be filtered through IPS and file policy and then not be processed by any further rules. I will post a screenshot of my rules below. Everything is functional I just want to make sure that there is not a better perhaps more elegant way to accomplish the same thing. I also don't want to have anything processing multiple times and causing unnecessary hardware utilization.

Rules 1 and 2 are the geofilter bypass rules (the names are cut off) and also IPS and file policy filtering for matching traffic, 3 and 4 are the inbound or outbound match rules and 5 is the IPS and file policy filtering for any traffic that makes it that far. I matched rule number 5 to the inside and outside zone to avoid filtering on an specific interface that I cannot have filtered. Is it okay that I have the source and destination zones as the same zone for both?

Any feedback would be greatly appreciated! 🙂

That looks pretty much like

Marvin Rhoads — Sun, 16 Apr 2017 21:37:24 GMT

That looks pretty much like how I would do it and how it's taught by Cisco.

I would only leave out the zones as I don't think they add any granularity that's not already implicit in the rest of the rules. (Unless you have other zones that aren't mentioned in your posting.)

There is one other zone

brandonbittinger — Sun, 16 Apr 2017 21:37:25 GMT

There is one other zone containing one interface that I need to exclude from the filtering. It connects to a partner network and FirePOWER causes some issues. Is that what you were referring too?

Other than that thank you for the feedback!

Ah ok - yes the excluded zone

Marvin Rhoads — Mon, 17 Apr 2017 06:31:22 GMT

Ah ok - yes the excluded zone was what I was referring to.

You're welcome.

topic Ah ok - yes the excluded zone in Network Security

FirePOWER Rules/Geofiltering

That looks pretty much like

There is one other zone

Ah ok - yes the excluded zone