firepower

firepower

1. Access control

   • Determines how traffic is handled, is it blocked, trusted or is it sent to the IPS
     • In a new policy, first create a default action. This will decide what happens to traffic that is not explicitly referenced in the default policy
       • traffic is matched against the first rule that matches all the conditions of the rule, rules are processed top down like an ACL
         • traffic can be matched by any combination of security zone, network, geographical location, port, application, URL and user
           • a rule must match all conditions to match
         • If not trusted or blocked
           • intrusion policy
           • file policy
             • The order of this if all 3 are enabled is that files will first be blocked, remaining files will be inspected in the cloud for AMP and any remaining will be inspected for intrusion traffic
           • advanced malware protection
     • Blacklisting occurs before the access control policy, so a blacklisted IP will not even be matched against the policy
     • remember to be careful of logging blocked DOS traffic, as logging can cause as much problem as the DOS attack itself.

2. Monitoring

   • Monitor command does not affect traffic flow but ensures logging is done on end of connection events regardless of what rules are matched

3. Network analysis policy

   • Takes place after blacklisting and before access control policy and intrusion policy
   • Normalizes and decodes data from various applications to mitigate evasion techniques