Firepower FTD - Transfer Packets

[jknox]

Hi,

I am hoping somebody can elaborate on the Transfer Packet feature/option when adding a device to the FMC.

The Cisco document says this option is on by default and that it the FTD device sends packet data with the events to the Firepower Management Center. So does this mean that if the FTD device has 1 Gig of data traffic transiting the device, then the device also sends a full copy of the packet payload(s) to the FMC ie the FMC effectively receives 1 Gig (ish...) of data?

The Cisco documentation does not really explain what this feature is really doing and a post from Todd Lammle (https://www.lammle.com/blog/4685/installing-cisco-firepower-important-questions-answer-start/) seem to indicate that it is sending the full payload.

I am thinking of locating the FMC in a central DC and managing multiple FTD devices at other remote sites/DC's over the Internet and I am struggling to figure out what the inbound bandwidth hit is going to be at the FMC end, especially if each FTD device is sending a full copy of the payload of every packet.

Has anybody got any experience of using the Transfer packet feature/option that they could share with me please.

Rgds

John

[Oliver Kaiser]

The Transfer Packet is used to sent packets to the FMC in case a certain event is triggered (e.g. snort detected pattern xy in packet -> send event + packet to fmc).

This option will not cause the sensor to send all traffic to FMC. Connection events will not include the actually payload but only metadata about the connection.

Let me know if this answers your question

[jknox]

Hi Kaisero,

Thank you for the quick reply.

Your answer makes total sense and is a lot clearer than the Cisco documentation.

I take it that transfer packet option is not just used for IPS/Snort events, but is also used for malware and file control events as well?

John

[Oliver Kaiser]

Malware/File events only contain metadata and not the blocked/detected payload.

In case a cloud lookup yields no result(disposition = unknown/unavailable) the sensor directly uploads the file to AMP ThreatGRID for dynamic analysis in case your File Policy is correctly configured.

You can see the results of the files analyzed in ThreatGRID at Analysis > Files > Captured Files. FMC polls information from ThreatGRID and updates the information shown in the Captured Files View.

kinds regards

Oliver

[#Mat]

Thanks kaisero.

[Rafael La Selva]

Hello @Oliver Kaiser,

Is it possible to enable this option after included on FMC 6.5?

Best Regards,

Rafael La Selva