Inside another inside interface not triggering firepower signatures

[babiojd01]

I can't seem to get firepower to alert on communication from 1 inside interface to another. I only get it to trigger when I go from inside to outside. Any thoughts? I even modified the HOME_NET to be any. I have the sfr policy global and the 2 interfaces are 1 inside interface and a subinterface off of that. 

[Philip D'Ath]

So the global policy only applies if an interface policy does not apply.

I normally apply the sfr policy to all interfaces except the outside interface (at least, every interface I want inspected), and let the global inspection policy (not using sfr) act on that.

[babiojd01]

Hi Philip,

So you do
service-policy sfr-service-policy interface inside

service-policy sfr-service-policy interface dmz

etc?

[Philip D'Ath]

Yes, that is my preferred deployment approach.

This differs from the way Cisco shows in their documents.  The nice thing about this way is you can still use FTP fixups and the like.