only one event triggered in cascade multiple context ASA

borutlape — Fri, 21 Feb 2020 15:59:59 GMT

Hi,

We have a pair of ASA 5585-X with Firepower ssp-60. They are deployed in multiple context mode, and the contexts are connected in cascade (traffic passes through multiple contexts).

All connections are logged twice in FMC, once on each context that logs the connection.

But when an attack is detected, only one event is generated, on one of the contexts.

So is this a normal/expected behavior or we have to do some adjustments?

Re: only one event triggered in cascade multiple context ASA

yogdhanu — Wed, 18 Jul 2018 17:19:58 GMT

Hi There,

its expected behavior. Firepower module is not fully aware of the context on ASA so traffic might travel through the module more than once which will be logged more than once.

But for the intrusion events, it will be only one event for duplicate traffic which will logged only once for intrusion event.

Hope it helps,

Yogesh

topic Re: only one event triggered in cascade multiple context ASA in Network Security

only one event triggered in cascade multiple context ASA

Re: only one event triggered in cascade multiple context ASA