Filter events in a Port mirror

[venbea]

Good morning:

I have a port mirror on an interface.
This traffic is causing intrusion events.
How can I filter them?
I've tried putting this traffic in a trust rule in the access control policy, but it doesn't work.
I've also tried putting it in a prefilter, but that didn't work either.

Any ideas?

[Ben Weber]

Hey @venbea 

For passive/port-mirroring interfaces, traffic only goes through the IPS engine, which means that the policies you have configured (Trust Rule, prefilter) aren't going to be hit by the traffic on the port-mirror. I think you need to tune your default Intrusion policy or else create a custom intrusion policy that has fewer rules. 

Worth checking out the below:

Solved: Exclude device from IPS policy? - Cisco Community

Firepower Management Center Device Configuration Guide, 7.1 - Inline Sets and Passive Interfaces [Cisco Secure Firewall Management Center] - Cisco