topic Re: Firepower access control rule for TCP session in Network Security

Firepower access control rule for TCP session

telmuun erdenebaatar — Fri, 21 Feb 2020 17:07:00 GMT

Hello all,

We have started implementing Firepower with FMC.

But every allow rule, we have to create reply incoming traffic rule for opposite direction. On older ASA, if we create one rule reply for that session is automatically allowed.

But now on Firepower our rule number is doubled.

Am i missing something, some configuration or proper way of doing things?

Re: Firepower access control rule for TCP session

Marvin Rhoads — Thu, 09 May 2019 04:50:28 GMT

That should not be necessary.

Firepower Threat Defense Access Control Policy Rules are the same as ASA Access Control List entries in that respect - both are for a stateful firewall which keeps a connection table of allowed traffic and will automatically allow the return half of the connection or flow.

Re: Firepower access control rule for TCP session

TM13 — Fri, 24 May 2019 03:55:32 GMT

Hi Marvin,

We using transparent inline mode and using security zone on the interface Outside and Inside, and return packets are blocked when reaching to other security zone and TCP restrict is not enabled, any specific configuration required or do we need to create a TAC for this

Re: Firepower access control rule for TCP session

Abheesh Kumar — Sat, 25 May 2019 20:16:07 GMT

Hi,
For transparent inline deployment, return rule is required as it is just inspecting(SNORT) the traffic which you are permitting to pass-through the firewall with source & destination security zones.

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/200924-configuring-firepower-threat-defense-int.html

Hope This Helps
Abheesh

Re: Firepower access control rule for TCP session

TM13 — Mon, 27 May 2019 07:53:37 GMT

Hi Abheesh,

Thanks for answer, so as traditional FW connection it will check "Existing connection" and pass the L3/L4 rule but still would be blocked on SNORT's L7 rules? and that SNORT Rule is IPS? because we enabled both File Policy(Malware) and IPS, so every connection would be checked on FirePower? this Prefilter Fast-Path rule is also required new rules to bypass SNORT? or possible to align/tie o current rules?

Re: Firepower access control rule for TCP session

Abheesh Kumar — Mon, 27 May 2019 08:04:01 GMT

Hi,

To bypass a traffic for inspection (SNORT, AMP) you can create a pre-filter rule and set action as fast-path. Pre-filter rules are same as like ASA access list there is no L7 inspection.

If the default action on prefilter policy is Analyse, it will send all the traffic to snort for further inspection.

Hope This Helps

Abheesh

Re: Firepower access control rule for TCP session

TM13 — Mon, 27 May 2019 08:57:18 GMT

Hi Abheesh,

Thanks, but we looking for possibility of return traffic can be bypassed, but seems that is not possible