FTD: ISO 8583 APP. Signature ID

[Gamal]

Hello,

We Have a valued customer that need to permit or deny Specific APP. called ISO 8583, When trying to use the app. from the Cisco Pre-defined APPs. List, I couldn't found it.

So, Is there any method to detect this APP. using the APP. detector or any other method to be able to block/Permit it through the access policies?!.

Thanks in advance,

[phil.hydea]

Hi Gamal

You can create a custom application detector in the FMC (Policies >
Application Detector).

The key thing you'll need if working from scratch is a PCAP of the ISO8583
connection so the FTD can detect the app in Layer 7 analysis.

https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Application_Detection.html#ID-2208-00000060

Once the application detector has been created, you can add it into your
ACP rule.

Hope this helps.
Phil