topic Hi Philip, in Network Security

Inside another inside interface not triggering firepower signatures

babiojd01 — Sun, 10 Mar 2019 13:33:17 GMT

I can't seem to get firepower to alert on communication from 1 inside interface to another. I only get it to trigger when I go from inside to outside. Any thoughts? I even modified the HOME_NET to be any. I have the sfr policy global and the 2 interfaces are 1 inside interface and a subinterface off of that.

So the global policy only

Philip D'Ath — Wed, 10 Feb 2016 03:15:27 GMT

So the global policy only applies if an interface policy does not apply.

I normally apply the sfr policy to all interfaces except the outside interface (at least, every interface I want inspected), and let the global inspection policy (not using sfr) act on that.

Hi Philip,

babiojd01 — Wed, 10 Feb 2016 12:53:39 GMT

Hi Philip,

So you do
service-policy sfr-service-policy interface inside

service-policy sfr-service-policy interface dmz

etc?

Yes, that is my preferred

Philip D'Ath — Wed, 10 Feb 2016 19:50:03 GMT

Yes, that is my preferred deployment approach.

This differs from the way Cisco shows in their documents. The nice thing about this way is you can still use FTP fixups and the like.