300-710 · Question #130
An organization is using a Cisco FTD and Cisco ISE to perform identity-based access controls. A network administrator is analyzing the Cisco FTD events and notices that unknown user traffic is being…
The correct answer is C. Add the unknown user in the Access Control Policy in Cisco FTD. When Cisco FTD and ISE are integrated, and unknown user traffic is allowed, the Cisco FTD's Access Control Policy (ACP) needs to be updated to specifically block traffic from these unknown users while legitimate user traffic remains unaffected.
Question
An organization is using a Cisco FTD and Cisco ISE to perform identity-based access controls. A network administrator is analyzing the Cisco FTD events and notices that unknown user traffic is being allowed through the firewall. How should this be addressed to block the traffic while allowing legitimate user traffic?
Options
- AModify the Cisco ISE authorization policy to deny this access to the user.
- BModify Cisco ISE to send only legitimate usernames to the Cisco FTD.
- CAdd the unknown user in the Access Control Policy in Cisco FTD.
- DAdd the unknown user in the Malware & File Policy in Cisco FTD.
How the community answered
(27 responses)- A4% (1)
- B4% (1)
- C81% (22)
- D11% (3)
Why each option
When Cisco FTD and ISE are integrated, and unknown user traffic is allowed, the Cisco FTD's Access Control Policy (ACP) needs to be updated to specifically block traffic from these unknown users while legitimate user traffic remains unaffected.
Cisco ISE's authorization policies primarily control initial network access and assign attributes, but the FTD's ACP is responsible for granular traffic enforcement through the firewall based on the identity information received.
Cisco ISE sends identity information for all authenticated users to FTD. It cannot selectively withhold 'legitimate' usernames, and blocking 'unknown' users is an FTD policy decision.
The Cisco FTD's Access Control Policy dictates which users or user groups are allowed or denied access to network resources. To block 'unknown user traffic,' a rule must be added or modified in the ACP to specifically deny traffic originating from the 'unknown user' identity or group, ensuring it is placed appropriately in the rule order.
Malware & File Policies are designed to inspect and block malicious files, not to control basic network access based on user identity.
Concept tested: Cisco FTD Identity-based Access Control Policy
Source: https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/identity_policies.html
Topics
Community Discussion
No community discussion yet for this question.