ASA 5500-x Firepower Configuration

[ragulan_dms]

Hi Guys,

I want to check on how to redirect the ASA traffic into firepower for IPS and AMP. Current ASA global policy match the default-inspection-traffic. I suppose this does not match all traffic. Hence wondering  what the general best practice for configuring service policy in ASA to enable the ASA Firepower inspection ? Meaning to say, Should I use the current global policy as it is or should I  modify the current global policy match to any any instead of default-inception-traffic ? 

Regards

Ragulan

[Marvin Rhoads]

Best practice varies according to what you are trying to inspect.

Many organizations match all and inspect that but if you have specific traffic you need to target then yours would be different.

Also if you have, for instance, a significant amount of traffic that you trust (like IPsec going to a termination point inside your network) then you would exempt that from inspection.

[johnd2310]

Hi,

You can use the global  policy as follows:

-Identify the traffic that you need to send to the IPS module.

-create a class-map for access-list

-apply the class-map under the global policy-map

access-list IPS extended permit ip any any

class-map IPS-TRAFFIC-CLASS
 description Traffic for IPS Processing
 match access-list IPS

policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect ip-options
  inspect icmp
  inspect snmp
class IPS-TRAFFIC-CLASS
  sfr fail-open

Thanks

John

[ragulan_dms]

Thanks John and Melvin. This means , for example, ftp traffic will go through both ASA inspection and firepower IPS ? 

[Patrick Moubarak]

Yes, ASA runs its own inspect and sends a copy of the packets to the Firepower module.

Firepower runs preprocessor and other advanced security (IPS, AMP...) on the connections and instructs the ASA to drop or reset a connection if needed.

Hope that helps.