Cisco FTD - Bypassing a Specific source IP from a specific Signature

[SHABEEB KUNHIPOCKER]

Hello,

We have Cisco FTD managed by FMC (both running version 7.4.2.1). We noticed that some of the emails from a specific to our email gateway that behind our FTD is getting blocked by the particular signature in our FTD. Now we need to bypass the traffic originating from the particular public IP from hitting this signature. I know that the simple option is to Clone the current intrusion policy, disable the signature and then write a new access control rule with the specific public IP as source our email gw as destination and then apply the new intrusion policy to this rule. But we don't want to go with that option since we will be sending 30000 duplicate signatures to FTD for just one bypass. We just need to know if there is a option to override the signature based on source IP. 

Thanks and Regards

Shabeeb

[balaji.bandi]

You can create another top rule to not to inspect, is this works for you ?

[SHABEEB KUNHIPOCKER]

You mean to say that we will clone the current intrusion policy and disable the problematic signature, then create a new access control policy and call this intrusion policy right?. The issue is that the customer is worried about the number of signatures that will be pushed. He is asking if I clone the intrusion policy then I will have another 10000 signatures pushed to the FTD which may affect performance.

Is there any option to exclude a particular source IP from a signature ?

[Marvin Rhoads]

There's no problem with having multiple intrusion policies on a given device. Of more concern to me would be why is this one device triggering an Intrusion event. If it's believed to be false positive, then a TAC case would be a better approach.

You can exclude a given address from the current intrusion policy globally via the access control policy. You cannot exclude an address from one signature (without creating a new policy).