FMC policy examples?

[JG1978]

Does anyone have any resources showing some good Policy examples for FTD (all the policies not just one)? We have had a FMC system running 4 FTD sensors for over a year now and we are struggling to get any real value from them.

I don't know what we are doing wrong here but our LDAP traffic is all being flagged as "Ultrasurf"....(TAC case opened 2 months ago....no progress)....another example is that our system is showing Malware/CNC traffic but everytime we go and investigate one of the PC's there is no other indications of anything malicious etc.

I was hoping to find some good samples to compare and see what we could be doing better. Our contracts are coming up soon and we may be heading in a different technology other then Cisco since Firepower has been a disaster for us.

[Marvin Rhoads]

Please have a look at the references mentioned in this thread:

https://community.cisco.com/t5/intrusion-prevention-and/moving-from-cx-to-firepower/m-p/3008915

Did you setup the systems on your own or did a partner field engineer do the initial setup? If the latter, they should have done a lot of the policies to start with. Otherwise "out of the box" there're several steps you need to perform and understand to get good discovery and protection.

[JG1978]

Our Cisco rep helped but really only did 1 policy which was a catch all of "any any". I have read a lot and have started to create my own policies but not really sure what best practices are. Firepower is a beast that can look at everything...its overwhelming to figure out what needs to be filtered etc.

I have a 2 month old TAC open because all of our LDAP (TCp 389) traffic is showing up as Ultrasurf instead of LDAP......our DNS sever is being flagged as our top attacker....it has not been a good experience.

That PDF looks like a great resource, I will look into it.

Thanks!

[Marvin Rhoads · Accepted solution]

It sounds like you really need somebody with Firepower experience to sit down and go through your setup and policies.

If you can't manage that then have a careful read of the links in the thread I mentioned earlier. you need at a minimum a basic object definition (HOME_NET and EXTERNAL_NET), network discovery policy and identity policy. Depending on where the Firepower device sits logically in your network, there may be other things you want to do with respect to prefilter, access control etc. that will enhance the fidelity of the reports and dashboards.