Where to check if sourcefire is blocking IP

[mahesh18]

Hi Everyone,

In our environment we are frequently asked to check specifc IP addresses to confirm if sourcefire is allowing the connection or not.

Need to confirm if Sourcefire DC is blocking any IP address which is the best place to check?

Under connection events?

or Security Intelligence events?

Regards

MAhesh

[Marvin Rhoads · Accepted solution]

I'd look under "Analysis, Search" make sure you specify a relevant time period for your search.

[mahesh18]

Many thanks Marvin

Regards

Mahesh

[Florin Barhala]

Hi Marvin,

Can you please bring more light over this. All is in place and "sh service-policy sfr" shows some drops.
How can we find out more about them? I went to Analysis \ Search but there're a lot of stuff there....

[Marvin Rhoads]

I usually right click on an "Allow" event and tell the FMC to exclude all events of that type. That pares down the list quite a bit. You can save that filter as an FMC bookmark as well.

[Florin Barhala]

I could spot a saved search named Dropped events as per the attachment - but this is a search within Intrusion Events.

What do you think?

[Marvin Rhoads]

That's a predefined search and, as you noted, specific to Intrusion Events. I don't believe it would include drops due to Security Intelligence, URL Blacklist or other miscellaneous reasons.

I use one like this:

FMC - Connection Events NOT Allowed

[anousakisioannis]

Hello,

I see the below results in  sh service-policy sfr command

Global policy:
Service-policy: global_policy
Class-map: FIREPOWER-Class
SFR: card status Up, mode fail-open
packet input 2718995, packet output 2719028, drop 357, reset-drop 40

Where can i see the 357 drops in FMC? 

Thank you