topic Re: Cisco Sandboxing in Network Security

Cisco Sandboxing

adamgibs7 — Fri, 21 Feb 2020 17:31:37 GMT

Dears,

I am planning to implement Fortinet Sand boxing solution and i have a ASA with firepower services, will this solution will work ??? the file which will be send to fortinet sandboxing by ASA will be recognized???

Please confirm.

Re: Cisco Sandboxing

Marvin Rhoads — Wed, 25 Sep 2019 15:05:34 GMT

A Cisco ASA (with or without Firepower services) has no capability that I am aware of to send files for analysis to third party products.

That is only available with Cisco's AMP license which uses the Cisco's Threatgrid cloud-based sandboxing services for analysis of unknown files.

Re: Cisco Sandboxing

adamgibs7 — Wed, 25 Sep 2019 17:11:46 GMT

Dear Marvin

Amazing, you have replies almost for all question i appreciate you dear.

so u are confirming me that it will not work with fortinet sandboxing solutions, but i want to know by what protocol FTD/ASA communicates with sandboxing either on cloud or on premises, if i m not wrong on cloud it will communicate with http/https or 8443, but what about on premises sand boxing solution.

That is only available with Cisco's AMP license which uses the Cisco's Threatgrid cloud-based sandboxing services for analysis of unknown files.

for the above sentence according to your reply , apart from the Threatgrid cloud-based sandboxing it can also work with on premises sandboxing solution. please correct me if i m not wrong.

Thanks

Re: Cisco Sandboxing

Marvin Rhoads — Thu, 26 Sep 2019 02:45:36 GMT

When you use Firepower with an AMP (File) license, it communicates with the AMP public cloud via https (TLS over tcp/443).

It does not provide any feature or function to integrate with a third party on-premise sandboxing solution.

It can work with an AMP private cloud appliance in conjunction with a Threatgrid on-premise solution.

https://www.cisco.com/c/en/us/products/collateral/security/fireamp-private-cloud-virtual-appliance/datasheet-c78-742267.html