The Cisco Secure Firewall comes with a default Network Discovery Policy which is configured for 0.0.0.0 discovering applications.
I'm commonly seeing some people doing 2 configurations:
- Edit default Network Discovery Rule:
. Delete 0.0.0.0 and put RFC 1918
. Add Host discovery
What I have learned it's the default rule should not be changed, because it will affect layer 7 capabilities:
So, I instruct customers to create a new rule for host discovery only internal networks.
You can also add a rule for exclusions Guest network, NAT devices, Proxies, partners coming through VPN.
I'd like to know what are you doing guys? What is your Best Practice? Are you trashing/changing the default rule 0.0.0.0 for application?
Obs:
I know if you configure host for 0.0.0.0 it will affect FMC host discovery limit, but I'm not talking about host discovery in the default, I'm talking about application discovery.
1 Comment
