Intrustion Policy in FMC

[damian.dyer]

We have a customer who migrate from a dedicated McAfee IPS sitting infront of their Cisco ASA to an all in one FTD device. The issue is previously the customer say all traffic flow through their IPS and got tones of alerts, logs and dropped traffic. Now they have the intrusion policy enabled on their access control policy. The default action at the bottom of the policy is set to Block All traffic. Since all traffic is being dropped and the traffic traversing the firewall is allowed traffic we see almost no Intrustion events and they are getting worried. 

Is there anything I can set to inspect the traffic before it is dropped?

[Aref Alsouqi]

The default action would apply to the traffic that didn't match a rule above. I would say it depends on how the IPS policies have been configured, if they are attached to the ACP rules and they are not triggered then I don't think there should be a reason to be worried about.

[damian.dyer]

The customer wants the data, is there a way to have the intrusion policys prefilter the traffic? 

[Aref Alsouqi]

They would get the logs if the IPS signatures/rules are triggered, alternatively can't see how that would be possible.

[damian.dyer]

Yea, that is what I was thinking. My customer has been paranoid that the IPS policies haven't been working because they are not triggering, even though when they run a pen test, all the rules will trigger on that source and destination.

[AigarsK]

As Aref said, Intrusion rules need to be enabled for this to work. Also, very important part is that you update the Variable set used against the Intrusion policy on you Access Policies.

Variable set has to specify what is HOME_NET aka all subnets that are considered on inside of the network. If you are doing Internal to Internal resource scanning for any intrusions, then a new Variable set needs creating where HOME_NET and EXTERNAL_NET are specified with all internal network subnets and ranges.

[Aref Alsouqi]

@AigarsK actually I'm glad you mentioned the variable sets because there is a big gotcha in there as shown in this post of mine where a potential attack might be overlooked:

Snort HOME_NET and EXTERNAL_NET Variables