Intrusion Rules in Cisco FMC

[NeWGuy1109]

I have configured around 300 rules in FMC.. a recent requirement is to apply an IPS Policy to all the rules..is there a way an Intrusion Policy can be applied all at once to an entire ACL ? its really inconvenient to edit 300 rules and apply an IPS Policy there.

Also, if i am not using inline mode does Intrusion Policy will act as an IDS only ? it wont drop any traffic ? in custom intrusion policy "drop when inline mode" is specific for inline modes only ?

Any help is appreciated

[Mohammed al Baqari]

Hi,

You can do this through FMC APIs. But from GUI that is not possible. You
can write your own API loop script to edit the setting.

**** please remember to rate useful posts

[NeWGuy1109]

Thanks...any link i can refer for such scripts? 

[Mohammed al Baqari]

Here you go

https://community.cisco.com/t5/network-security/python-scripts-to-create-and-delete-hosts-on-firepower-manager/td-p/4100224

https://community.cisco.com/t5/network-security/my-python-script-to-query-fmc-api-for-list-of-sensor-names-and/td-p/3737313

**** please remember to rate useful posts

[NeWGuy1109]

If i do not select "Drop when Inline" will the IPS function as an IDS only regardless of rule actions ?

[Marvin Rhoads · Accepted solution]

Just select all the rules in the ACP at once (select first one, hold down shift key and then select last one) and right click to edit. You may need to change your display rules per page (bottom right) so that you can see and select all of them at once.

Common tasks (such as IPS policy) will be selectable to change them.

FMC - edit multiple rules

[NeWGuy1109]

Incredible !!!  that was very helpful Marvin.

One more thing if you can please help out with.. if in IPS policy i have unchecked "Drop when Inline" will my policy act as an IDS ?

[Marvin Rhoads]

Deselecting "Drop when Inline" will indeed make the sensor function like what is sometimes referred to as an Intrusion Detection System (IDS) vs. an Intrusion Prevention System (IPS). I seldom see that used in practice though as it removes most of the utility of actually preventing intrusions.