In our environment we are frequently asked to check specifc IP addresses to confirm if sourcefire is allowing the connection or not.
Need to confirm if Sourcefire DC is blocking any IP address which is the best place to check?
Under connection events?
or Security Intelligence events?
Solved! Go to Solution.
I usually right click on an "Allow" event and tell the FMC to exclude all events of that type. That pares down the list quite a bit. You can save that filter as an FMC bookmark as well.
That's a predefined search and, as you noted, specific to Intrusion Events. I don't believe it would include drops due to Security Intelligence, URL Blacklist or other miscellaneous reasons.
I use one like this:
I see the below results in sh service-policy sfr command
SFR: card status Up, mode fail-open
packet input 2718995, packet output 2719028, drop 357, reset-drop 40
Where can i see the 357 drops in FMC?