topic Network Analysis Policies in Network Security

Network Analysis Policies

adamgibs7 — Fri, 21 Feb 2020 15:22:59 GMT

Dears,

I have kept network analysis policies in a passive mode ( default mode) but the access control policies has default action of IPS that means if the traffic doesn't match it will pass by the IPS,

I have not enabled a network analysis policies that means a firepower is not configured properly or I can keep passive Network analysis policy and Inline IPS that makes more sense

I shld keep both inline.

Re: Network Analysis Policies

babiojd01 — Tue, 20 Feb 2018 21:08:08 GMT

How is the sensor deployed? What is the policy map settings if its ASA+FP?

Re: Network Analysis Policies

Dinesh Verma — Wed, 21 Feb 2018 03:18:00 GMT

A network analysis policy governs how traffic is decoded and preprocessed so that it can be further evaluated, especially for anomalous traffic that might signal an intrusion attempt.

if you put NAP policy in passive, means traffic won't be dropped by any of the pre-processors if it matches with those GIDs. (preprocessors won't affect the traffic).

We should keep both in Inline mode.

Regards,

Re: Network Analysis Policies

adamgibs7 — Wed, 21 Feb 2018 08:47:52 GMT

If I am keeping only one inline will it be a high security risk ??

Re: Network Analysis Policies

adamgibs7 — Wed, 21 Feb 2018 19:29:08 GMT

anybody can justify the below, if I keep only one in inline does it will be considered as a high security risk.

Re: Network Analysis Policies

argrullo — Wed, 21 Feb 2018 21:06:02 GMT

Hello Team,

The network analysis as stated, is where the Snort preprocessors reside. They are mainly used to normalize the traffic. If its inline and there is some anomalous traffic, it can be dropped here.

We cannot state if this would be a security vulnerability for you since we do not know your network.

I can do tell that most customer have it Inline/ dropping with the Balanced Security and Connectivity policy as the default.

[cid:image002.png@01D3AB2D.C8339CA0]

Thus normally, a default/basic environment, I recommend the Inline Mode for the Network Analysis Policy and the Intrusion Prevention Policy. With Balanced Security and Connectivity as the Base Policy.

If the policy is passive, you will just need to ensure to review your logs more often and take action on any IPS events.