Thanks man, this was really helpful.  I can't make null0 / black hole interface on my low end Firepower so I just made access rule where I block all RFC1918 traffic going outside interface and that was it.

Hi, did you solve this issue? I have the same problem. APs are not reconnecting in remote location, that are connected with ipsec tunnel. I need to manually reload these APs every time I have ISP problem.

Actually TAC resolved this issue in my case  Here is summary copied from this case: - Found that FTD was not receiving user_ip mappings from the FMC- We removed the old entries in /ngfw/var/sf/user_enforcement- We then restarted pmtool and ran the d...

Did you resolve this issue? I have the same problem. TAC is not helping with this 