firepower allow rule with no IPS vs trust rule

[tato386]

What would be the difference between an allow rule with no IPS policy selected and a trust rule?  

TIA

[balaji.bandi]

check this flow to help you :

https://www.cisco.com/c/en/us/td/docs/security/firepower/610/configuration/guide/fpmc-config-guide-v61/access_control_rules.html

[tato386]

That diagram is pretty good.  So it looks like if no IPS and no file policy is selected then it appears NAP is the only difference.  Is it safe to assume that SI comes before any type of ACP rule and therefore is applied to all traffic before any rules at all are tried to match?

[balaji.bandi]

There is a good thread that also have how packet flow takes place in more detailed :

https://community.cisco.com/t5/network-security/firepower-network-analysis-and-intrusion-prevention-policy/td-p/4408916

[tato386]

That diagram is a bit more challenging to decipher than the first one you suggested.  Looking at the SI (IP) module it  appears that it takes input from both the DAQ and the ACP but how can we tell what ACP rules are feeding SI?  Do trust rules feed back into SI?

[Marvin Rhoads]

Security Intelligence (assuming it is configured) will be enforced whether or not a given ACP rule (aka "L7 ACL" in the flow diagram in the linked thread) has an IPS policy, trust rule or something else. The idea is that SI eliminates the need to further analyze known bad packets before handing off to the more computationally intensive subsystems.

[tato386]

Page 128 of this Cisco Live session confirms SI is applied to Trust rules.

https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2019/pdf/BRKSEC-3300.pdf

Thank you!

[balaji.bandi]

yes, that is a good presentation, i was afraid to offer that link, sometimes people do not have access to cisco live on demand.

Hope you have cleared your doubt now.

[tato386]

yes, thank you!

[TheGoob]

Interesting topic, I also had similar question/s. I feel the diagram earlier in the discussion was indeed the answer I too was seeking but wanted to clarify with worded response opposed to what I believe a diagram to be telling me.

FPR1010 w/ 8 STATIC IP's. 6 Usable. Would setting 1 of the IP's to "trust" essentially make it "all open" and then another firewall [not] the FPR1010 can do the ACL's etc? So trust bypasses all security and allows anything in or out on that specific trust rule?

[tato386]

I would say yes but if you are going to run your public IPs thru the FPR1010 (routed mode) it would mean you would also have to NAT the 2nd IP to the outside interface/IP of your 2nd firewall which would have a private IP.  I would try to avoid the double NAT if possible.