300-710 · Question #108
An organization wants to secure traffic from their branch office to the headquarter building using Cisco Firepower devices, They want to ensure that their Cisco Firepower devices are not wasting…
The correct answer is C. Configure the Cisco Firepower devices to bypass the access control policies for VPN traffic. To prevent Cisco Firepower devices from wasting resources inspecting already-secured VPN traffic, a specific Access Control Policy rule should be configured to allow this traffic without further deep inspection.
Question
An organization wants to secure traffic from their branch office to the headquarter building using Cisco Firepower devices, They want to ensure that their Cisco Firepower devices are not wasting resources on inspecting the VPN traffic. What must be done to meet these requirements?
Options
- AConfigure the Cisco Firepower devices to ignore the VPN traffic using prefilter policies
- BEnable a flexconfig policy to re-classify VPN traffic so that it no longer appears as interesting
- CConfigure the Cisco Firepower devices to bypass the access control policies for VPN traffic.
- DTune the intrusion policies in order to allow the VPN traffic through without inspection
How the community answered
(22 responses)- A9% (2)
- B5% (1)
- C82% (18)
- D5% (1)
Why each option
To prevent Cisco Firepower devices from wasting resources inspecting already-secured VPN traffic, a specific Access Control Policy rule should be configured to allow this traffic without further deep inspection.
Prefilter policies are primarily used for quick traffic disposition before reaching the Access Control Policy, not specifically for bypassing deep inspection while still allowing access control. Trust rules in ACP are more appropriate.
FlexConfig policies are for applying custom CLI configurations and are not the standard mechanism for re-classifying traffic to bypass inspection.
Cisco Firepower's Access Control Policy allows the creation of 'Trust' rules which permit specific traffic, such as VPN traffic, to bypass deep inspection services like intrusion prevention, file, and malware policies, thereby conserving system resources.
Tuning intrusion policies modifies how specific threats are handled; it is not the mechanism to completely bypass all inspection for an entire class of traffic like VPN.
Concept tested: Cisco Firepower Access Control Policy - Trust action
Source: https://www.cisco.com/c/en/us/td/docs/security/firepower/660/configuration/guide/fpmc-config-guide-660/access_control_policies_and_rules.html#concept_f5b_nfw_cbb
Topics
Community Discussion
No community discussion yet for this question.