I have a client with ASA multicontext firewall running with Firepower 6.1 in it. They have limited bandwidth for Firepower on it with multiple 10 gig lines so they are restricting which traffic gets redirected to Sourcefire Module for fiiltering. They are trying to keep those ACLs as simple as possible, and are seeing results they arent totally happy with. Question is:
If you redirect specific traffic to the sourcefire based on an ACL associated with a service-policy per-interface, do those ACLs need to be bidirectional? What they are seeing for example is Inside-DMZ not getting redirected but the return traffic from DMZ-Inside on the same TCP session is getting redirected. Is that redirection bidirectional per-interface? Do they need an ACL that would say
permit Inside to Servers
permit Servers to Inside
on the same ACL if that policy was a class-map SFR for service-policy on the interface Inside?
Right now they just have "inside to Servers" and are still seeing redirects from "Servers to Inside", reportedly on same interface. I know its easy to test but wanted to ask the forum if that is the correct config method to use bidirection ACL on a specific interface policy for redirection to SFR module?
Thanks!
