SourceFire ASA installation and configuration

[jadesha.jeer1]

Hello Team,

Recently we have installed software based SourceFire ASA but its not in production, however now we are planning to get SourceFire ASA to production for URL filtering and traffic management. As of now we have setup FireSight management system and uploaded SFR image to ASA. Currently ASA is acting as exit/entry point of internet traffic to our network. I have few doubts as follows:

1) In ASA I can see sfr module is up but what happens if I console the sfr module will it affect my normal traffic of internet while i'm in sfr console.

2) Is there any basic configuration templates for url filtering to make job easier.

3) What are the check-list to cross verify before get sfr inline module in production.

Thanks in advance for all your help.

Thanks- Jadesh

[Marvin Rhoads · Accepted solution]

We redirect traffic to the FirePOWER module using the modular policy framework something like this:

policy-map global_policy
class class-default
sfr fail-open
service-policy global_policy global

Generally, what you do on the sfr module console won't affect the parent ASA. Until you have the service policy redirecting traffic nothing will go through or be affecting by the sfr module. As long as you have the "fail-open" the the sfr module going down or being reset won't affect ASA production traffic.

Of course once you are directing traffic through it and start implementing policies, you have the potential to block or otherwise affect that traffic.

Beyond the User and Admin guides, you might take a look at the Lab Minutes series that was done recently. They do a nice job of walking your through some basic tasks.

[jadesha.jeer1]

Hello Marvin,

I really thanks you and appreciate your answer given above, surely this will boost my confidence by clearing my doubts. Today I'll will redirecting traffic to sfr inline module and will share the results soon.

Thanks- Jadesh

[jadesha.jeer1]

Hey Marvin,

Finally, I have successfully installed sourcefire firewall into production network. Lab minutes series really helped in many ways in this activity... :) cheers

[Marvin Rhoads]

Great.

Please mark the original question as answered if it helped.