FTD Firepower Policy

[Fotiosmark]

Hi Team!

I am having some "trouble/issue" with setting a Policy in the FMCv.

I have manage to create a Malware policy to block Malware (Block with reset), Ok that works fine.

But at the same time when I am downloading the same Malware with HTTPS/SSL, it allows it!????!??!?

The same is with PDF files. I have created a policy to Block PDF files. Thats fine except when HTTPS is used which allow them.

Any thoughts?

[Octavian Szolga · Accepted solution]

Hi,

Have you configured an SSL decryption policy?

If not, that's normal. You can't block what you can't see.

HTTP is clear-text, HTTPS is encrypted. Being encrypted, means (by default at least) that you don't have any data visibility from sensor's perspective.

Regards,

Octavian

[Fotiosmark]

Indeed, :)
Do I configure the decryption policy from Acess Control - SSL - Create Rule? Because under that, there are choices as Decrypt - Resign, Decrypt - Known Key - Block - Block with Reset