Outside Interface Traffic host IP

[ahsan1]

Hi,

Is there any option in firepower2110 to know the source/host IP's, which are hitting my outside interface from inside along with using application.

[Marvin Rhoads]

Assuming you are logging connections then yes. Just filter the analysis > connections table to include only the inside subnets in the source field and outside address in the destination field.

[ahsan1]

Thanks Marvin for the reply. 

Actually, i have seen increase in traffic on one of my firepower outside interface directly connected with ISP but unable to trace which source IP is hitting that interface and for which application it is using to increase in sudden traffic.

[Marvin Rhoads]

Do you have any identity integration (like via ISE or AD Agent)? If so, you should be able to see the "Traffic by User" widget in your summary dashboard.

You can also look at the "Top Client Applications Seen" widget for additional information.