permit ip ifc outside any any

[velusamycs]

We have FMC and FTD , In FMC we configured Blocked traffic ACCESS POLICY , but while checking in FTD(CLI) one more ACL( Ifc Outside any any allow) showing with same rule-id 26844160.   any ideas how to find this ACL in FMC



ACL in FTD 
========
access-list CSM_FW_ACL_ line 17 remark rule-id 268441601: ACCESS POLICY: FTD-Mig-ACP-1584501209 - Default
access-list CSM_FW_ACL_ line 18 remark rule-id 268441601: L7 RULE: Blocked Traffic
access-list CSM_FW_ACL_ line 19 advanced deny ip ifc outside host x.x.x.x any rule-id 268441601 (hitcnt=0) 0x70ce5f02
access-list CSM_FW_ACL_ line 20 advanced permit ip ifc outside any any rule-id 268441601 (hitcnt=39080962) 0x8793b97e

FMC 

Thank you 

[Marius Gunnerud]

The access rule will show up as permit any any if you are using any services that is inspected by SNORT to drop the traffic.  That would include Geo location, URL filtering, Application, etc.  As the action is being taken in the SNORT process the LINA ACL needs to permit the traffic so it can reach SNORT which is why you are seeing a permit any any rule.

[titusroz03]

Does the SNORT engine handles(Allow/deny) the packet as per the LINA ACL..?

[velusamycs]

Based on Below reference its expected, Pls correct me  if am wrong. 

https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-threat-defense/218196-understand-how-lina-rules-configured-wit.html
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwd00446

[MHM Cisco World]

You can try 

System support trace

Which from my opinion must accurte than packet tracer to show traffic path through snort

MHM

[MHM Cisco World]

Share output of

System support trace 

MHM

[Marius Gunnerud]

Yes you are correct.  Any traffic that will be sent to snort for inspection and action will have an any any permit rule.  This is to allow the traffic through LINA so it can reach SNORT where further action will be taken.

[Marvin Rhoads]

Exactly correct @velusamycs - thanks for those links.

[Aref Alsouqi]

I agree with @Marius Gunnerud, the packet would need to leave Lina engine going to Snort engine, Snort then returns a verdict of that packet marking it to be allowed or dropped, it doesn't allow it or block it itself. However, as mentioned by @Marius Gunnerud if you don't have any next gen security inspection features enabled on the ACP, you wouldn't see that allow rule you shared because in that case Snort engine wouldn't be involved.