FTD prefilter policy

[peterhw]

Does prefilter policy in FTD support stateful inspection ? or I have to created two rules for outgoing and return traffic.

[Mohammed al Baqari]

If supports stateful. Once the connection is created and matching prefilter
it will be flagged in statetable. Return packets matching this connection
won't be punted to snort engine

[peterhw]

 Refer to https://www.cisco.com/c/en/us/td/docs/security/firepower/610/configuration/guide/fpmc-config-guide-v61/prefiltering_and_prefilter_policies.html , FTD prefilter policy is unidirectional, how to explain it ?

[Mohammed al Baqari]

If my understanding is correct this is related to traffic initiation not
stateful. Being stateful doesn't mean that you are bidirectional.