topic Re: Firepower - file trajectory in Network Security

Firepower - file trajectory

cadet — Fri, 21 Feb 2020 17:44:04 GMT

Hello!

Network file trajectory:

"Cisco maps how hosts transfer files, including malware files, across your network. It can see if a file transfer was blocked or the file was quarantined. This provides a means to scope, provide outbreak controls, and identify patient zero." - https://www.cisco.com/c/m/en_us/products/security/firewalls/competitive-comparison.html#~competitive=0

What products do customers need to offer to implement the "Network file trajectory" features?

If we don't put Firepower into the east-west path of the traffic than we can not see file trajectory across customer network without additional products such as, for example, AMP for Endpoint ?!

So, in design (case 1 in attach) without AMP for Endpoint do I not see file trajectory between host B and C ?

Or do I need additional Firepower between host B and C (case 2 in attach) or AMP for Endpoint on both hosts ?

Could you correct me if I am wrong?

Re: Firepower - file trajectory

Rob Ingram — Thu, 28 Nov 2019 20:09:36 GMT

Hi,

It probably wouldn't be feasible or scalable to put a Firepower appliance in between host B and C in order to filter intra VLAN traffic. You should implement AMP for Endpoints.

HTH

Re: Firepower - file trajectory

cadet — Thu, 28 Nov 2019 20:49:57 GMT

Definitely 🙂

So, does AMP for Endpoint is mandatory element in file trajectory functionality?

Re: Firepower - file trajectory

Rob Ingram — Thu, 28 Nov 2019 21:00:00 GMT

Yes you use AMP4E to get that information you require. You can also integrate with ISE in order to quarantine the device in infected.

Re: Firepower - file trajectory

cadet — Thu, 28 Nov 2019 21:18:13 GMT

does Firepower can to quarantine the device if infected without ISE ?

Re: Firepower - file trajectory

Rob Ingram — Thu, 28 Nov 2019 21:27:56 GMT

You need ISE to quarantine. When quarantined ISE would send a DACL down to the switchport an infected device is connected to, which would restrict lateral movement within the VLAN for that device. Thus preventing the spread of malware/virus etc to other devices on the network.