Hello, I am testing a Cisco ASA 5515-x with Firepower (IPS, AMP, URL Filtering licenses). I have created and applied an Access Control Policy. At the moment traffic at L3 - L4 in our organization is blocked by ASA firewall. With SFR module I want to block Skype, Teamviewer, Torrent and intrusions from Internet.
My IPS policy is applied to Threat Inspection rule that is the last rule in the AC Policy. From what I understand any traffic will be allowed, if it will be accepted by the IPS and AMP policies. The problem is that if I disable rule number 8 (Deny Torrent), then I can download torrent files and I am able to download torrent content using Utorrent application, but i think that this traffic should be dropped by IPS Policy. If I enable rule number 8, torrents file download is prohibited but not all torrent traffic is dropped (some of my torrents in Utorrent continue to download). I thought that IPS policy that is attached to the Threat Inspection rule is going to block all traffic that IPS Policy matches as intrusion traffic. When I check events I see that Inline result for torrent traffic is "dropped". Why I am able to download torrents in Utorrent?
Accepted Solutions
I thought that if I apply IPS Policy, then I don't have to create any Access Control Rules to block torrent traffic, because IPS Policy is going to block it.
Do you mean that the IPS Policy doesn't play any role in blocking torrent traffic? Is it blocking anything if it is attached to the Threat inspection allow rule in my case?
Cisco documentation says that if I have an allow access control rule and I apply the IPS and File Policies than Firepower module will allow the packet only if it passes IPS and File policies. In my case I thought that if I have the rule at the end that says allow any any and has attached the IPS policy, torrent traffic will not pass through IPS policy and would be dropped.
