You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on Aug 13, 2022. It is now read-only.
# Firewall Management Center (FMC) access control policies
2
+
3
+
This Learning Lab teaches a basic understanding of managing FMC access control policies with the REST API.
4
+
5
+
## Objectives
6
+
The objective of this lab is to teach:
7
+
8
+
* What access control policies are.
9
+
* How to perform GET and POST operations on FMC access control policies to configure NGFW and other Firepower devices.
10
+
11
+
## Prerequisites
12
+
13
+
* A development environment with typical tools and applications, as well as [Postman](https://www.getpostman.com/).
14
+
* Basic understanding of REST principles. Complete the [REST API Fundamentals Learning Lab](https://learninglabs.cisco.com/tracks/devnet-beginner/rest-api-fundamentals/what-are-rest-apis/).
15
+
* Basic understanding of FCM REST APIs and the FMC REST API Explorer. Complete [Exploring Firepower Management Center (FMC) REST APIs](https://learninglabs.cisco.com/modules/Firepower/firepower-restapi-101/).
This lab teaches a basic understanding of FMC access control policies and CRUD operations using REST API. You will learn how to do operations (GET, POST) on Firepower management center (FMC) access control policy to configure NGFW and other Firepower devices.
6
-
7
-
## Prerequisites
8
-
It's best if you have a basic understanding of REST principles, Firewalls, FMC REST API.
9
-
10
-
## Firepower Management Center (FMC) policy
11
-
Access control is a hierarchical policy-based feature that allows you to specify, inspect, and log (non-fast-pathed) network traffic. Especially useful in multidomain deployments, you can nest access control policies, where each policy inherits the rules and settings from an ancestor (or base) policy. You can enforce this inheritance, or allow lower-level policies to override their ancestors. Each managed device can be targeted by one access control policy.
3
+
Access control is a hierarchical policy-based feature that allows you to specify, inspect, and log (non-fast-pathed) network traffic. You can nest access control policies, such that child policies inherit the rules and settings from a parent or base policy. You can enforce this inheritance, or allow child policies to override their parents. Each managed device can be targeted by one access control policy.
12
4
13
5
The data that the policy’s target devices collect about your network traffic can be used to filter and control that traffic based on:
14
6
@@ -17,34 +9,28 @@ The data that the policy’s target devices collect about your network traffic c
17
9
* Realm, user, user group, or ISE attribute.
18
10
* Custom Security Group Tag (SGT).
19
11
* Characteristics of encrypted traffic; you can also decrypt this traffic for further analysis.
20
-
* Whether unencrypted or decrypted traffic contains a prohibited file, detected malware, or intrusion attempt, each type of traffic inspection and control occurs where it makes the most sense for maximum flexibility and performance. For example, reputation-based blacklisting uses simple source and destination data, so it can block prohibited traffic early in the process. In contrast, detecting and blocking intrusions and exploits is a last-line defense.
12
+
* Whether unencrypted or decrypted traffic contains a prohibited file, detected malware, or intrusion attempt.
13
+
14
+
Each type of traffic inspection and control occurs where it makes the most sense for maximum flexibility and performance. For example, reputation-based blacklisting uses simple source and destination data, so it can block prohibited traffic early in the process. In contrast, detecting and blocking intrusions and exploits is a last-line defense.
21
15
22
16
Although you can configure the system without licensing your deployment, many features require that you enable the appropriate licenses before you deploy. Also, some features are only available on certain device models. Warning icons and confirmation dialog boxes designate unsupported features.
23
17
18
+
## Access control policy components
19
+
20
+
**Name and description**: Each access control policy must have a unique name. A description is optional.
24
21
25
-
### Access control policy components
22
+
**Inheritance settings**: Policy inheritance allows you to create a hierarchy of access control policies. A parent (or base) policy defines and enforces default settings for the child policies, which is especially useful in multidomain deployments. A policy's inheritance settings allow you to select its base policy. You can also lock settings in the current policy to force any child policies to inherit them. Child policies can override unlocked settings.
26
23
27
-
##### **Name and description**
28
-
Each access control policy must have a unique name. A description is optional.
29
-
##### **Inheritance settings**
30
-
Policy inheritance allows you to create a hierarchy of access control policies. A parent (or base) policy defines and enforces default settings for its descendants, which is especially useful in multidomain deployments. A policy's inheritance settings allow you to select its base policy. You can also lock settings in the current policy to force any descendants to inherit them. Descendant policies can override unlocked settings.
24
+
**Policy assignment**: Each access control policy identifies the devices that use it. Each device can be targeted by only one access control policy. In a multidomain deployment, you can require that all the devices in a domain use the same base policy.
31
25
32
-
##### **Policy assignment**
33
-
Each access control policy identifies the devices that use it. Each device can be targeted by only one access control policy. In a multidomain deployment, you can require that all the devices in a domain use the same base policy.
26
+
**Rules**: Access control rules provide a granular method of handling network traffic. Rules in an access control policy are numbered, starting at 1, including rules inherited from ancestor policies. The system matches traffic to access control rules in top-down order by ascending rule number. Usually, the system handles network traffic according to the first access control rule, where all the rule’s conditions match the traffic. Conditions can be simple or complex, and their use often depends on certain licenses.
34
27
35
-
##### **Rules**
36
-
Access control rules provide a granular method of handling network traffic. Rules in an access control policy are numbered, starting at 1, including rules inherited from ancestor policies. The system matches traffic to access control rules in top-down order by ascending rule number. Usually, the system handles network traffic according to the first access control rule, where all the rule’s
37
-
conditions match the traffic. Conditions can be simple or complex, and their use often depends on certain licenses.
28
+
**Default action**: The default action determines how the system handles and logs traffic that is not handled by any other access control configuration. The default action can block or trust all traffic without further inspection, or inspect traffic for intrusions and discovery data. Although an access control policy can inherit its default action from a parent policy, you cannot enforce this inheritance.
38
29
39
-
##### **Default action**
40
-
The default action determines how the system handles and logs traffic that is not handled by any other access control configuration. The default action can block or trust all traffic without further inspection, or inspect traffic for intrusions and discovery data.
41
-
Although an access control policy can inherit its default action from an ancestor policy, you cannot enforce this inheritance.
30
+
**Security intelligence**: Security Intelligence is a first line of defense against malicious internet content. This feature allows you to blacklist (block) connections based on the latest IP address, URL, and domain name reputation intelligence. To ensure continual access to vital resources, you can override blacklists with custom whitelists.
42
31
43
-
##### **Security intelligence**
44
-
Security Intelligence is a first line of defense against malicious internet content. This feature allows you to blacklist (block) connections based on the latest IP address, URL, and domain name reputation intelligence. To ensure continual access to vital resources, you can override blacklists with custom whitelists.
32
+
**HTTP responses**: When the system blocks a user’s website request, you can either display a generic system-provided response page, or a custom page. You can also display a page that warns users, but also allows them to continue to the originally requested site.
45
33
46
-
##### **HTTP responses**
47
-
When the system blocks a user’s website request, you can either display a generic system-provided response page, or a custom page. You can also display a page that warns users, but also allows them to continue to the originally requested site.
34
+
**Advanced access control options**: Advanced access control policy settings typically require little or no modification. Often, the default settings are appropriate.
48
35
49
-
##### **Advanced access control options**
50
-
Advanced access control policy settings typically require little or no modification. Often, the default settings are appropriate.
In a simple access control policy, the default action specifies how target devices handle all traffic. In a more complex policy, the default action handles traffic that:
1
+
# Access control policy default action
2
+
3
+
In a simple access control policy, the default action specifies how target devices handles all traffic. In a more complex policy, the default action handles traffic that:
4
+
3
5
* is not trusted by Intelligent Application Bypass.
4
6
* is not blacklisted by Security Intelligence.
5
7
* is not blocked by SSL inspection (encrypted traffic only).
@@ -8,6 +10,8 @@ or inspect—traffic).
8
10
9
11
The access control policy default action can block or trust traffic without further inspection, or inspect traffic for intrusions and discovery data.
10
12
13
+
The following table lists different default actions and what they do to network traffic.
14
+
11
15
| Default Action | Effect on Traffic | Inspection Type and Policy |
***The following diagrams illustrate the Block All Traffic and Trust All Traffic default actions.***
25
-
26
-
27
-
28
-
***The following diagrams illustrate the Intrusion Prevention and Network Discovery Only default actions.***
29
-
30
-
31
-
24
+
The following diagrams provide visual representations of these actions.
32
25
33
-
### Access control policy inheritance
34
-
Access control uses a hierarchical, policy-based implementation that complements multitenancy. Just as you create a domain hierarchy, you can create a corresponding hierarchy of access control policies. For a descendant, or child, access control policy inherits rules and settings from its direct parent, or base, policy. That base policy may have its own parent policy from which it inherits rules and settings, and so on.
An access control policy’s rules are nested between its parent policy’s Mandatory and Default rule sections. This implementation enforces Mandatory rules from ancestor policies, but allows the current policy to write rules that preempt Default rules from ancestor policies.
28
+
37
29
38
-
You can lock the following settings to enforce them in all descendant policies. Descendant policies can override unlocked settings.
39
-
*`Security Intelligence` — blacklisting and whitelisting connections based on the latest IP address, URL, and domain name reputation intelligence.
40
-
*`HTTP Response pages` — displaying a custom or system-provided response page when you block a user's website request.
41
-
*`Advanced settings` — specifying associated subpolicies, network analysis settings, performance settings, and other general options.
30
+
42
31
43
-
Although an access control policy can inherit its default action from an ancestor policy, you cannot enforce this inheritance.
0 commit comments