Cisco Firepower Management Center - negate object/network

[marco.iacono]

Hello together,

does anyone know if it is possible to negate an object or network in the policies?

Unfortunately I have not found anything for this.

I wanted to create a rule for Internet Access (allow any to "not RFC1918" http and https) just as an example.

Anyone have an idea or is this not possible in the FMC?

[Marvin Rhoads]

You'd have to use two entries. First entry would to block http and https to RFC 1918 network object. Second entry to permit http and https to any destination. Rules are processed from top down with rule processing stopping after first matched entry (with action other than monitor).

[Cristian Matei]

Hi,

     Yes you can, by using the excluded list in your network object definition.

Regards,

Cristian Matei.

[Marvin Rhoads]

Hi Cristian,

Can you explain in more detail how to use an excluded list in a network object or object group definition? I don't see that option in my FMC running 6.5.0.2.

[Cristian Matei]

Hi,

   I meant "network variables". So you define a new network variable set, you include the networks and exclude the specific ranges. You than select in your access-control policy rule the newly defined variable set, from inspection tab. Although the variable set is used for intrusion policies, in the end you attach the intrusion policy to your access-control policy rules. There are some restrictions, read carefully in the Configuration Guide, in the Managing Reusable Objects section, Variable Sets.

Regards,

Cristian Matei.

[Marvin Rhoads]

@Cristian Matei would excluding the objects from inspection by the IPS policy have the effect of blocking the connections in the associated Access Control Policy rule?

I would have thought the effect would be to exempt the excluded network(s) from IPS inspection once the associated rule action was determined - but not blocking the TCP connections in the first place.

[Cristian Matei]

Hi,

@Marvin Rhoads Yes Marvin, that is correct, i read the first questions "which says policies" and i replied, thinking IPS policies. If he needs to "negate networks" for ACP, he actually needs multiple ACP rules; if he needs to "negate networks" for IPS, he needs variable set.

Regards,

Cristian Matei.