Firepower - file trajectory

[cadet]

Hello!

Network file trajectory: 

"Cisco maps how hosts transfer files, including malware files, across your network. It can see if a file transfer was blocked or the file was quarantined. This provides a means to scope, provide outbreak controls, and identify patient zero." - https://www.cisco.com/c/m/en_us/products/security/firewalls/competitive-comparison.html#~competitive=0

What products do customers need to offer to implement the "Network file trajectory" features?

If we don't put Firepower  into the east-west path of the traffic than we can not see file trajectory across customer network without additional products such as, for example, AMP for Endpoint ?!

So, in design (case 1 in attach) without  AMP for Endpoint do I not see file trajectory between host B and C ?

Or do I need additional Firepower between host B and C (case 2 in attach) or AMP for Endpoint on both hosts ?

Could you correct me if I am wrong?

[Rob Ingram]

Hi,

It probably wouldn't be feasible or scalable to put a Firepower appliance in between host B and C in order to filter intra VLAN traffic. You should implement AMP for Endpoints.

HTH

[cadet]

Definitely :)

So, does AMP for Endpoint is mandatory element in file trajectory functionality?

[Rob Ingram]

Yes you use AMP4E to get that information you require. You can also integrate with ISE in order to quarantine the device in infected.

[cadet]

does Firepower can  to quarantine the device if infected without ISE ?

[Rob Ingram · Accepted solution]

You need ISE to quarantine. When quarantined ISE would send a DACL down to the switchport an infected device is connected to, which would restrict lateral movement within the VLAN for that device. Thus preventing the spread of malware/virus etc to other devices on the network.