Security Intelligence Feature

fatalXerror — Fri, 21 Feb 2020 17:48:12 GMT

Hi Guys,

I am using security intelligence in my firepower system to block and white-list URLs however, it seems to be not working it still goes to the verdict of my access control list and not the security intelligence.

Thanks.

Re: Security Intelligence Feature

Muhammad Awais Khan — Thu, 02 Jan 2020 07:49:06 GMT

Hi,

As per the packet flow of FTD, the blacklisted traffic in SI config will be dropped. It seems your whitelisted URL's is going through the ACL policies which seems to be a normal behavior.

The whitelisted policies only whitelists the specific URL's defines in the blacklists.

I am attaching a snapshot of Packet flow in FTD software code

Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/610/configuration/guide/fpmc-config-guide-v61/security_intelligence_blacklisting.html

topic Re: Security Intelligence Feature in Network Security

Security Intelligence Feature

Re: Security Intelligence Feature