Service Policy For SFR

[Harmeet Singh]

i,

My configuration is:

access-list TEST extended permit ip host x.x.x.x host y.y.y.y

access-group TEST out interface outside

class-map IPS

 match access-list TEST

policy-map global_policy

 class IPS

  sfr fail-open monitor-only

service-policy global_policy global

Now i have a confusion. As shown above I have an ACL and applied on outside interface for outward direction.

Can I use the same ACL for direction the traffic to SFR module because the ACL is applied on outgoing interface and traffic goes to SFR before touching the outgoing interface.

Harmeet

[Philip D'Ath]

Yes, you could use the same access-list for both.  It would be easier though to pass all traffic through FirePower ...

policy-map pm-asasfr
 class class-default
  sfr fail-open

service-policy pm-asasfr interface outside