Network Security

Cisco Firepower 1120 Upgrade to 7.2.x makes VLAN not work

Hello,We upgraded our firewall to latest update 7.2.0.1-12 but then our VLANs dont work.I can see traffic of my pings, between vlans, endpoints etc but getting "request timed out" nor access anything even though i see the traffic, its like its bugged...

Resolved! Redistribute default route in ospf in FTD

Hello guys I have this topology where the inside network runs with ospf and in the ftd there is both default route and ospf ?After configuring all this also my inside network cannot go to the internet or the isp ip.My question is how do i redistribut...

ISE vs a ethernet y cable splitter

In my corporate environment, IT won't give permission for a switch, they wants us to lay more cable, but it's too expensive. Leadership doesn't understand and says just use WiFi. ISE of course prevents using a switch without permission; ISE will de...

Saving captures/pcap directly to SFTP server

Hello Experts @Rob Ingram @balaji.bandi I have ASA and running the capture for SMTP with a max buffer size of around 35 mb and with overwrite option enabled but this is not enough for my use case.I want to run packet capture which will continue for ...

Resolved! ISE-PIC and FMC

Hello,I had installed Cisco FMC 6.6.4 version and ISE-PIC 2.7 version for Passive Authentication. Everything worked pretty fine but then I upgraded FMC up to 7.0.1 and ISE-PIC has some issues. When I try to integrate FMC 7.0.1 with ISE-PIC 2.7 I see ...

Resolved! Ping block is the best way for Security ?

Hi , I noticed that some network disable the ping and some security engineer disable the ping in network. I also found some article that Disabling ICMP won’t increase security. What is the best practice ? If we enable ping , how to protect the attack...

FTD 4145 Firewall Cluster Etherchannel

We have two FirePower FTD 4145 firewalls operating in FTD cluster mode. The devices below the firewall cluster is a pair of Catalyst 6807 switches running in vss mode. Above the firewall cluster is a pair of Catalyst 9500 switches that have been stac...

Cannot ping remote site address pool from inside interface

I have got below interface:Machine01 (10.0.2.221)<-------> Inisde(10.0.2.0/24)<-------> ASA<-------> Outside(10.0.1.0/24) <------->(pool-192.168.100.0/24) Client (192.168.100.22) I have got below route table for inside interface in AWS: I am able to ...

FTD ACP Policy Inheritance

I have an ACP base policy from which my FTD devices inherit from See attached Pic) Is there a better way I can do this as I can't re-order the rules in the ACP policies that are inheriting these rules from the base policy. So Site A, B, C & D ACP al...

Resolved! Firepower IPS inspection

Is IPS a "Set it and forget it" type deal? Say I have 50 rules in my ACP and select balanced & security for every rule and on top of select a file & malware policy would this not kill the performance? What do you guys typically do to manage this? I...

FTP to ASA

I am trying to re-mage an SFR module on an ASA but when I do a system install via ftp, I get a permission denied error. I have ruled out the FTP server as the issue as I am able to FTP to a totally different set of firewalls so that should rule out t...

Resolved! ASA5516-x unable to set TLSv1.2

Hi all We have an ASA-5516X with the latest recommended version 9.16(2). I get the below error. I should be able to use TLS1.2 along with DTLSv1 no? ssl server-version tlsv1.2 ? configure mode commands/options:<cr>ssl server-version tlsv1.2 dtlsv1.2^...

FPR 1140 upgrade

Hi Team, Please share FPR 1140 upgradation ver 6.6.x to 7.0.2 step/guide

FMC Interface 'DataplaneInterface0' is not receiving any packets

We have a HA pair of ASA 5508-X configured as active/standby and installed FirePower on each device. In FMC, we get the error "Interface 'DataplaneInterface0' is not receiving any packets" for the standby device as below. Do you have any other ap...