File Policy + access control rule

[zaferberber]

i wanna check the malicious file activity on local network (client network)

i created file policy with malware cloud lookup (with both direction) and ips policy for outbound communication (including malware rules.....)

the access control rule like this;

source Local Network -> Dst Any   with file policy and oubound ips policy (home_net=local network)

any suggestion writing the reverse rule ?

regards

zafer

[babiojd01]

I don't believe you need a reverse rule beings the conversation is kept track of with Initiator and responder. File policy should match the downloaded file from the internet and perform the lookup. Firepower experts can correct me if I am wrong.