Firesight Access Control policies

[adamgibs7]

Dears,

Please find the attached screenshot,

IF no ACP matches then my default action  is inline IPS  then how come I  can see the connection events with "Initial Passive Network Analysis Policy" actually I don't know what is Initial Passive Network Analysis Policy" and why it is hitting.

thanks

[Marvin Rhoads]

The Default action in your Access control Policy (ACP) probably has a "Send connection Events to Event Viewer"logging setting.

Click on the little scroll icon in the bottom right of your ACP to check it.

[adamgibs7]

Dear Marvin,
can you elaborate more on your reply, actually I didn't understood.
thanks