ASA Firepower with Automatic Application Bypass (AAB) and Intelligent Application Bypass (IAB)

[u.drechsel]

Hi all,

I'm using ASA5585-X SSP40 (version 9.4.(2)6 ) with Firepower 6.0.1.2. Because of performance issues I've activated AAB for testing purposes. In the documentation I found:

"If detection is bypassed, the device generates a health monitoring alert."

I also activated IAB in test mode for application category "very low risks"

I want to know, how often these events occures and what kind of information it contains. Does anybody know, how I can identify these events in the Health monitor or via CLI?

Thank you,

Sincerely,

Uwe

[Claudiu Cismaru]

Hello,

When AAB triggers you'll get an event in Health Events. It will trigger once a packet will take more than configured threshold until gets out on the output interface.

IAB should be configured for large flows identified (like SMB traffic, large downloads over non HTTPS flows).