FTD prefilter vs Access policy deny all rule

[tato386]

I'm trying to mimic the implicit deny all rule found on ASA devices in an FTD environment. My setup includes servers that live on the inside LAN and have 1-to-1 NAT rules and which need to have certain services exposed to the Internet. I plan to use prefilter to allow traffic to these ports mostly because they are voice services that I would rather not subject to FTD inspection.

My question is should I add the "deny all" to the end of the prefilter rules or should I use the access control policy default rule for this? I am leaning towards doing it on the prefilter to more closely mimic a typical ASA environment but since this is FTD, maybe I should use the default action of ACP?

Thanks,
Diego

[Marvin Rhoads]

If your prefilter has a deny for just those hosts following the permit specific ports then that is fine. if it is truly "deny all" then nothing will ever get to your ACP (or Snort IPS). At that point you basically have a more expensive and complicated ASA.

We generally put a default rule of Deny All at the end of the ACP, especially for Internet edge firewalls.

[tato386]

Yes, of course the deny would not be a true "deny all" it would just be applied to inbound connections to the natted hosts.  (I should have been more specific about that).  The reasoning behind using prefilter is that we don't want to inspect traffic that we don't allow anyway. Which is one of the reasons why prefilter option exists, yes?  To be sure, I assume this rule would only block traffic initiated from the outside and would not apply to return traffic from connections initiated from the natted hosts.

[Marvin Rhoads · Accepted solution]

Correct - what you're proposing is a good use of prefilter policy.

[tato386]

sounds good.  One last thing, is there any difference between having a full "deny all" at the end of the ACP ruleset vs having the default action of the policy set to "block all".  If I use the default action I would have one les rule in the policy which is good for keeping things simple and tidy but I wouldn't mind adding it if there is some added benefit.

[Marvin Rhoads]

Putting it as the default action ensures that someone doesn't come by and accidentally put a new rule below a "deny all" in the rule section. For a less careful admin, that latter scenario would result in the intended new rule never being hit.

[tato386]

excellent.  thank you