topic Re: Outside Interface Traffic host IP in Network Security

Outside Interface Traffic host IP

ahsan1 — Fri, 21 Feb 2020 15:46:51 GMT

Hi,

Is there any option in firepower2110 to know the source/host IP's, which are hitting my outside interface from inside along with using application.

Re: Outside Interface Traffic host IP

Marvin Rhoads — Thu, 17 May 2018 12:47:05 GMT

Assuming you are logging connections then yes. Just filter the analysis > connections table to include only the inside subnets in the source field and outside address in the destination field.

Re: Outside Interface Traffic host IP

ahsan1 — Fri, 18 May 2018 04:54:35 GMT

Thanks Marvin for the reply.

Actually, i have seen increase in traffic on one of my firepower outside interface directly connected with ISP but unable to trace which source IP is hitting that interface and for which application it is using to increase in sudden traffic.

Re: Outside Interface Traffic host IP

Marvin Rhoads — Fri, 18 May 2018 13:34:19 GMT

Do you have any identity integration (like via ISE or AD Agent)? If so, you should be able to see the "Traffic by User" widget in your summary dashboard.

You can also look at the "Top Client Applications Seen" widget for additional information.