How to retrieve IPS Policies from Firepower Management System or Appliance

[Tang-Suan Tan]

Hi all,

I have tried to retrieve the IPS Policies from Cisco IPS by Firepower Management Centre (FPMC) or by Appliance itself but I am unable to.

May I knwo any way to retrieve the IPS policies either from the IPS systems (FPMC or Appiance) or from its backup file?

Plaese advise. Thanks!

regards,

Tangsuan Tan

[caroldso]

Hi Tan,

Please refer to the below link for taking backup from Firepower:

https://www.cisco.com/c/en/us/td/docs/security/firepower/650/configuration/guide/fpmc-config-guide-v65/backup_and_restore.html

You have an option to choose only "Back Up Configuration".

Regards,

Carol

[Tang-Suan Tan]

Hi Carol,

Thanks to your reply.

After Backup Configuration, is it anyway to extract the Policies from the Backup configuration?

Thanks!

regards,

Tangsuan Tan

[Marvin Rhoads · Accepted solution]

The IPS policies (thousands of rules) cannot be exported directly.

You can export a report of the Access Control Policy (ACP) and related elements. At the top level view in FMC of Policies > Access Control click on the small report icon on the right side of the screen next to the ACP.

[Tang-Suan Tan]

Hi Marvin,

Yes, I have generate the Report according to your suggestion.

Thanks to your help on this.

regards,

Tangsuan Tan

[caroldso · Accepted solution]

Hi Tan,

The policies cannot be viewed in user-readable format from the backup file. For user-readable, you could either use the below command on the managed device:

> show access-control-config

Or reporting option under the fmc.

[Tang-Suan Tan]

Hi Carol,

I have followed the way suggested by Marvin to retrieve from FMC.

Your method by CLI should produce the same result from FMC, right? Any way, thanks to your help on this.

regards,

Tangsuan Tan

[caroldso]

Hi Tan,

Yes, It would.

[Marvin Rhoads]

The show command provided by @caroldso needs to be run on the sensor cli, not on the FMC.

[Tang-Suan Tan]

Hi Marvin,

Thanks to your advice. I got what you mean and I have tried it at the Appliance and it works.

regards,

Tangsuan Tan