cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
6358
Views
10
Helpful
4
Replies

Bypass Firepower SFR for certain traffic

GRANT3779
Spotlight
Spotlight

I have similar to the following -


policy-map global_policy
class Class_FP
sfr fail-open

class-map Class_FP
match any

service-policy global_policy global

If I want certain traffic to not go to the Firepower SFR what is the best way to achieve this? Running ASA 5516X. I'm sure it is causing some problems for two hosts.

Thanks

4 Replies 4

Marvin Rhoads
Hall of Fame
Hall of Fame

Change your class-map rule from "match any" to be an access list which exempts the hosts you want to bypass the sfr module.

sorry to reply to an old thread:

so if i have:

where my Internal-Networks is a group of subnets etc., that will in theory bypass sfr for all Internal-Networks group?

ASA# sh run access-list | include global_mpc_1
access-list global_mpc_1 extended deny ip any object-group Internal-Networks
access-list global_mpc_1 extended permit ip any any
ASA# 

 

Hi,

you can create service policy which selects the internal subnet which you don't need to send through FP module. then you can deselect FP inspection for those networks.

 

regards,

Please rate this and mark as solution/answer, if this resolved your issue
Good luck
KB

Did that work? I have a similar need to have some traffic bypass inspection. Thanks in advance.

Review Cisco Networking for a $25 gift card