cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
543
Views
0
Helpful
2
Replies
Highlighted
Beginner

Question about ASA ACL Redirect to Firepower

I have a client with ASA multicontext firewall running with Firepower 6.1 in it.  They have limited bandwidth for Firepower on it with multiple 10 gig lines so they are restricting which traffic gets redirected to Sourcefire Module for fiiltering. They are trying to keep those ACLs as simple as possible, and are seeing results they arent  totally happy with. Question is:

If you redirect specific traffic to the sourcefire based on an ACL associated with a service-policy per-interface, do those ACLs need to be bidirectional? What they are seeing for example is Inside-DMZ not getting redirected but the return traffic from DMZ-Inside on the same TCP session is getting redirected.  Is that redirection bidirectional per-interface? Do they need an ACL that would  say

permit Inside to Servers

permit Servers to Inside

on the same ACL if that policy was a class-map SFR for service-policy on the interface Inside?

Right now they just have "inside to Servers" and are still seeing redirects from "Servers to Inside", reportedly on same interface. I know its easy to test but wanted to ask the forum if that is the correct config method to use bidirection ACL on a specific interface policy for redirection to SFR module?

Thanks!

Everyone's tags (1)
1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Advisor

You will need to define both

You will need to define both directions in the ACL. Even though the ASA is stateful, the traffic that gets sent to SFR is not.

HTH

View solution in original post

2 REPLIES 2
Highlighted
Advisor

You will need to define both

You will need to define both directions in the ACL. Even though the ASA is stateful, the traffic that gets sent to SFR is not.

HTH

View solution in original post

Highlighted
Beginner

Thanks for verfying. Just

Thanks for verfying. Just wanted to be certain.