Cisco Secure Firewall - Default Network Discovery Policy for Apps

[vagner.araujo]

The Cisco Secure Firewall comes with a default Network Discovery Policy which is configured for 0.0.0.0 discovering applications.

I'm commonly seeing some people doing 2 configurations:

- Edit default Network Discovery Rule:
 . Delete 0.0.0.0 and put RFC 1918
 . Add Host discovery

What I have learned it's the default rule should not be changed, because it will affect layer 7 capabilities:

So, I instruct customers to create a new rule for host discovery only internal networks. 

You can also add a rule for exclusions Guest network, NAT devices, Proxies, partners coming through VPN.

I'd like to know what are you doing guys? What is your Best Practice? Are you trashing/changing the default rule 0.0.0.0 for application?

Obs:
I know if you configure host for 0.0.0.0 it will affect FMC host discovery limit, but I'm not talking about host discovery in the default, I'm talking about application discovery.

[ccieexpert]

you are correct.. the applications discovery should discover applications for every network. Whereas as hosts and users should be limited to the internal network (and DMZ if you want to protect those).. bascially what you want to protect.. if you put 0/0 for host discovery, it will quickly exceed the host limit...