ASA FirePower and Protocol Inspection

[WILLIAM STEGMAN]

When I begin forwarding traffic to an ASA's firepower module, either in-line or monitor only mode, do I need to disable the traditional protocol inspection offered by the ASA such as is found in the global policy map that inspects http, ftp, icmp, etc?  I know ftp inspection allows for some active ftp connections, and turning it off might impact production.  Is anyone aware of any recommendations or caveats regarding deploying the firepower module and conflicts with traditional protocol inspection?

thank you, 

Bill

Update, this is addressed at:

http://www.cisco.com/c/en/us/td/docs/security/asa/quick_start/sfr/firepower-qsg.html#pgfId-139412''

Looks like it only applies to HTTP

[Dinkar Sharma]

Hi William,

You don't need to disable any other protocol Inspection. I believe the document refers to disable HTTP inspection in regards to Scansafe.You would simple be adding more overhead in traffic inspection if FirePOWER is performing URL filtering (HTTP/HTTPS) inspection for you.

Thanks,

Dinkar

[Massimo Baschieri]

Hi Dinkar,

isn't the sourcefire network analysis policy a protocol inspection by itself?

I was wondering if the two interfere to each other, or at least it it's a cpu wasting having both enabled.

Regards,

Massimo.

[Rishabh Seth]

Hi Massimo,

Adding to what Dinkar has suggested, the inspection on ASA is used to make changes in the layer 7 header of application such as FTP. So if you have NAT for the FTP traffic, the ASA inspection would be used to create pinholes and perform IP translation on the layer7 payload of FTP traffic. Whereas, the inspection on sourcefire is used to permit/deny the traffic based on the security policies on sfr.

So basically ASA and SFR works in tandem to provide overall control on traffic.

Hope it answers your query.

Thanks,

R.Seth

Rate if it helps!!

[Massimo Baschieri]

Hi Rishabh,

your exposition is absolutely clear to me, but what happens to sourcefire if asa inspection is configured to block or altering traffic based on L7 payload?

Is asa inspection happening before or after sourcefire?

Thanks,

Massimo.

[Rishabh Seth]

As per my understanding the ASA inspection takes place before the SFR.

For compatibility you can refer the link which Dinkar has suggested in his post. Here is an excerpt from the same doc:

Compatibility with ASA Features

The ASA includes many advanced application inspection features, including HTTP inspection. However, the ASA FirePOWER module provides more advanced HTTP inspection than the ASA provides, as well as additional features for other applications, including monitoring and controlling application usage.

You must follow these configuration restrictions on the ASA:

• Do not configure ASA inspection on HTTP traffic that you send to the ASA FirePOWER module.
• Do not configure Cloud Web Security (ScanSafe) inspection on traffic that you send to the ASA FirePOWER module. If traffic matches both your Cloud Web Security and ASA FirePOWER service policies, the traffic is forwarded to the ASA FirePOWER module only. If you want to implement both services, ensure there is no overlap between the traffic matching criteria for each service.
• Do not enable the Mobile User Security (MUS) server; it is not compatible with the ASA FirePOWER module.

Other application inspections on the ASA are compatible with the ASA FirePOWER module, including the default inspections.

Hope it helps!!!

Thanks,

R.Seth

Mark the answer as correct if it helps in resolving your query!!!

[Massimo Baschieri]

Thank you Rishabh!!!

[tgrundbacher]

Hi all

Does anybody know of recommendations for FTD deployments regarding inspects? Since good ol' ASA code still runs the lower layers of FTD, have the inspects gone, or are they applied in the background with default settings? I can't find anything inspect-related on the FTD platform setting in the FMC which is where I'd look for them.

Concrete question: My customer would like to make strict HTTP checks, e.g. he doesn't want to allow Telnet connections on port 80 towards HTTP servers. How would you configure such protocol enforcement options in FTD? I'm not sure how I'd have to configure this using HTTP configuration preprocessors...

Toni