Network Security · Topic 7 of 8
Access Control, AVC, URL Filtering and Threat Inspection on FTD
Implement FTD access control rules and actions, AVC, URL filtering, file and malware policy and intrusion policy on Cisco Secure Firewall Threat Defense.
- 5 min
- Access control rules match top to bottom, and the first match wins.
- Allow permits and can inspect. Trust permits and skips deep inspection.
- Block drops silently, and Block with reset sends a TCP reset.
What it is
On Cisco Secure Firewall Threat Defense (FTD), the access control policy decides what traffic is allowed and which inspections apply.
One policy joins several features. Rules match traffic by zone, network, user, application and URL. Each rule has an action, and an allowed connection can also be sent to a file policy and an intrusion policy.
How it works
Build the policy from the outside in: early filtering, rules and then the deep inspection that each rule enables.
Prefilter and rule order
A prefilter policy handles simple traffic very early, using only outer header information. It can fastpath, block or analyze a flow. Fastpath skips deeper inspection, which suits trusted high volume traffic.
Access control rules are checked from top to bottom, and the first match decides. Put specific rules above general ones. If no rule matches, the policy default action is applied.
Rule actions
| Action | Effect |
|---|---|
| Allow | Permits the traffic, and can still apply file and intrusion inspection |
| Trust | Permits the traffic and skips deep inspection |
| Monitor | Logs the traffic and continues to match later rules |
| Block | Drops the traffic silently |
| Block with reset | Drops the traffic and sends a TCP reset |
| Interactive Block | Shows a warning page that the user can bypass |
The difference between Allow and Trust is a classic question. Allow still lets the file and intrusion policies inspect the flow, while Trust does not.
Default action
The access control policy default action covers anything that matches no rule. The choices include blocking all traffic, or allowing traffic with an intrusion policy applied, or network discovery only. A block all default is the safest starting point.
Application visibility and control
AVC identifies the application inside a flow, such as a social media or file sharing service, instead of relying only on ports. You can then allow or block an application, or a whole category, and set risk and business relevance filters. A rule that blocks a risky application category works even if the application changes port.
URL filtering
URL filtering uses Cisco Talos data to assign each site a category and a reputation. A rule can match categories, such as gambling or malware sites, and a reputation level from untrusted to favourable.
| Reputation level | Meaning |
|---|---|
| 1 Untrusted | Known to be harmful |
| 2 High risk | Likely harmful |
| 3 Questionable | Some risk |
| 4 Neutral | Not known to be harmful |
| 5 Favorable | Good reputation |
Encrypted web traffic hides the URL path, so a decryption policy is needed to inspect it in depth. Without decryption, the firewall can still use the server name and certificate information for category checks.
Malware and file policy
A file policy is attached to an access control rule. It detects file types and checks them for malware. Typical rule actions are detect files, block files, malware cloud lookup and block malware.
The cloud lookup compares a file hash to Cisco intelligence. Unknown files can be sent for dynamic analysis in a sandbox. If a file is later found to be malicious, a retrospective event is raised, so you can see which hosts received it.
Intrusion prevention
An intrusion policy uses Snort rules to detect and block exploits. Cisco supplies base policies that trade security against performance.
| Base policy | Focus |
|---|---|
| Connectivity over Security | Fewer rules enabled, fewer false positives and best performance |
| Balanced Security and Connectivity | The recommended starting point |
| Security over Connectivity | More rules enabled, more alerts and a risk of false positives |
| Maximum Detection | The broadest rule set, for high security |
Rules attached to an access control rule are evaluated only for traffic that the rule allows. Rule updates arrive from Talos, and tuning removes noisy rules.
Deploying and checking
Changes made in FMC take effect only after you deploy them to the device. After deployment, review connection events and intrusion events to see which rule matched. The connection event shows the access control rule name and the action taken.
What to remember for the exam
Seven facts cover most questions on this topic.
- Access control rules match top to bottom, and the first match wins.
- Allow permits and can inspect. Trust permits and skips deep inspection.
- Block drops silently, and Block with reset sends a TCP reset.
- Prefilter can fastpath trusted traffic before the access control rules.
- URL filtering uses a category and a reputation from Talos.
- A file policy handles malware, and an intrusion policy uses Snort rules.
- Policy changes in FMC take effect only after deployment.
If a question asks how to skip IPS and file inspection for trusted traffic, think Trust or prefilter fastpath.
Common mistakes
These four mistakes appear often.
Putting a broad Allow rule above a specific Block rule. The first match wins, so the Block rule is never reached.
Choosing Trust when inspection is required. Trust skips the intrusion and file inspection.
Expecting URL control in encrypted traffic without decryption. Only limited information is visible without a decryption policy.
Forgetting to deploy. The device keeps running the old policy until you deploy.
Do not use Maximum Detection as a default without tuning it. It can cause many false positives and reduce throughput.
Check yourself
Work through these three questions.
What is the difference between the Allow and Trust actions?
Allow permits the traffic and can still apply file and intrusion inspection, while Trust permits it and skips deep inspection.
Why does rule order matter in an access control policy?
Rules are checked from top to bottom and the first match decides, so a broad rule can hide a more specific one below it.
What must you do after changing a policy in FMC?
Deploy the changes to the device, because the device keeps running the old policy until you do.
Topic 7 of 8 in Network Security
Test yourself on Network Security
The full Cisco CCNP 350-701 SCOR question bank has 822 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.