Solved: rule writing help for Cisco Firepower Management Center

jeff_baptiste · ‎03-07-2017

I have some vulnerability scanners that are hitting my load-balancers. The load-balancers are SNATing the connections. So Firepower sees the sources as the Load-balancers going to various destination on my network. However, in the packet, I see the Original Client IP (X-Forwarded-For header). I am trying to find a way that I can trust this connection as long as I see that scanner IP in the packet. Is there a way that I can do this either through Rule-writing or Access control rules?

Ajay Saini · ‎03-10-2017

Hello,

Not an expert in Firepower but trying to help.

For the x-forwarded-for criteria, you can use 'original client' option instead of source ip address.

When you edit the rule, under 'Networks', check under the source Networks, there is a tab for 'Original Client' which is referred to 'X-Forwarded-For'

http://www.cisco.com/c/en/us/td/docs/security/firesight/541/user-guide/FireSIGHT-System-UserGuide-v5401/Intrusion-Events.html

Then you can use that criteria to Trust the traffic.

HTH

-

AJ

View solution in original post

Ajay Saini · ‎03-10-2017