Cisco AMP for Networks without AMP for endpoints

[patelvc7601]

Hi 

I have a hard time finding information regarding this.

What kind of protection provided by only Cisco AMP for networks if we do not have Cisco AMP for endpoints.

How it will track file trajectory without AMP for endpoint ?

is there any document that differentiate the service provided by different component ( AMP for ESA ,AMP for WSA/CWS etc...)

Sincerely

Viral Patel

[yogdhanu]

Hi

So essentially AMP for network would scan traffic only when it passes through the firepower so its bases on network. AMP for endpoint stays on endpoint and communicates to cloud for protection of its host.

You would find more information about trajectory in firepower config guide.

http://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/fpmc-config-guide-v60_chapter_01011110.html

http://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise-networks/advanced-malware-protection/at-a-glance-c45-731875.pdf

I am not aware  of any doc about direct comparison of AMP with firepower, ESA and WSA but this link might give little more detail.

http://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise-networks/advanced-malware-protection/at-a-glance-c45-731876.pdf

Rate if it helps.

Yogesh

[c.screpanti]

Hi all,

Do I have to register a Management with cloud AMP, I have Malware licenses. From the logs on the matters I see this error :

 SF-IMS[28387]: [28659] SFDataCorrelator:imcloudpool [WARN] Can't register: Can't send data
 stunnel: LOG3[19700:140682608998144]: CONNECT request rejected...

Can someone help me?

Thanks

[yogdhanu]

Hi

For network AMP with firepower, you don't have to manually register. Once you have malware license all should be good.

If your FMC is behind proxy server or the traffic is subject to SSL decryption, please bypass that and it should work.

Allow connections from FMC to outside without any change. You can also bypass connections to

cloud-dc.amp.sourcefire.com.

Rate if helps.

Yogesh