Activating NGFW features on Firepower in Datacenter

[mateens]

Hi,

I have a 4115 FTD at datacenter. Traffic from several locations passes through the firewall. These are connected through IPVPN and IPsec VPN to access resources in the datacenter ca.5000+ clients. Customer want NGFW features activated on the firewall for increased security after migrating from ASA. All licenses are active.

1. What is best practice for activting these features in this type of environment ? IPS,URL Filtering,AMP,AVC 

2. Is there any prefered order or level ?

3. Is it possible to start with lowest possible settings for these and tighten them gradually over time ?

@Marvin Rhoads  @Mohammed al Baqari 

[Marvin Rhoads]

IPS with balanced security and connectivity ruleset along with Firepower recommendations setting is always a good start. URL Filtering is only of use if there is Internet-bound traffic going through the firewall. AMP is only of use if you see the streams with files in an unencrypted form. So a lot depends on the traffic flowing through the firewall.