When I begin forwarding traffic to an ASA's firepower module, either in-line or monitor only mode, do I need to disable the traditional protocol inspection offered by the ASA such as is found in the global policy map that inspects http, ftp, icmp, etc? I know ftp inspection allows for some active ftp connections, and turning it off might impact production. Is anyone aware of any recommendations or caveats regarding deploying the firepower module and conflicts with traditional protocol inspection?
Update, this is addressed at:
Looks like it only applies to HTTP
You don't need to disable any other protocol Inspection. I believe the document refers to disable HTTP inspection in regards to Scansafe.You would simple be adding more overhead in traffic inspection if FirePOWER is performing URL filtering (HTTP/HTTPS) inspection for you.
isn't the sourcefire network analysis policy a protocol inspection by itself?
I was wondering if the two interfere to each other, or at least it it's a cpu wasting having both enabled.
Adding to what Dinkar has suggested, the inspection on ASA is used to make changes in the layer 7 header of application such as FTP. So if you have NAT for the FTP traffic, the ASA inspection would be used to create pinholes and perform IP translation on the layer7 payload of FTP traffic. Whereas, the inspection on sourcefire is used to permit/deny the traffic based on the security policies on sfr.
So basically ASA and SFR works in tandem to provide overall control on traffic.
Hope it answers your query.
Rate if it helps!!
your exposition is absolutely clear to me, but what happens to sourcefire if asa inspection is configured to block or altering traffic based on L7 payload?
Is asa inspection happening before or after sourcefire?
Does anybody know of recommendations for FTD deployments regarding inspects? Since good ol' ASA code still runs the lower layers of FTD, have the inspects gone, or are they applied in the background with default settings? I can't find anything inspect-related on the FTD platform setting in the FMC which is where I'd look for them.
Concrete question: My customer would like to make strict HTTP checks, e.g. he doesn't want to allow Telnet connections on port 80 towards HTTP servers. How would you configure such protocol enforcement options in FTD? I'm not sure how I'd have to configure this using HTTP configuration preprocessors...