18-Access Control Policy

Access Control Policy:
Use the access control policy to control access to network resources. The policy consists of a set
of ordered rules, which are evaluated from top to bottom. The rule applied to traffic is the first
one where all the traffic criteria are matched. If no rules match the traffic, the default action
shown at the bottom of the page is applied.
To configure the access control policy, select Policies > Access Control. Click the > button next
to the rule number in the left-most column to open the rule diagram. The diagram can help you
visualize how the rule controls traffic. Click the button again to close the diagram.
Trust Allow traffic without further inspection of any kind.

Allow Allow the traffic subject to the intrusion policy.
Block Drop the traffic unconditionally. The traffic is not inspected.
If no rules match the traffic, the default action shown at the bottom of the page is applied.
1 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 056 430 3717

Select Policies > Access Control. To create a new rule, click the + button. In Order, select where
you want to insert the rule in the ordered list of rules. In Title, enter a name for the rule. The
name cannot contain spaces. You can use alphanumeric characters and these special
characters. Select the action to apply to matching traffic. Define the traffic matching criteria
using any combination.
Source/Destination—The security zones (interfaces) through which the traffic passes, the IP
addresses, or the protocols and ports used in the traffic. The default is any zone, address,
geographical location, protocol, and port.
Application—The application, or a filter that defines applications by type, category, tag, risk, or
business relevance. The default is any application. The system identifies applications based on
layer 7 criteria, so that you can write rules for different web-based applications rather than a
single rule that covers all TCP port 80 (HTTP) traffic. Although you can specify individual
applications in the rule, application filters simplify policy creation and administration.

URL—The URL or URL category of a web request. Use the URL criteria to implement URL
filtering, controlling user access to web sites. Although you can filter on specific URLs by
configuring URL objects or groups, it is much more efficient to filter by web category and
reputation.
Users—The user or user group. Your identity policies determine whether user and group
information are available for traffic matching. You must configure identity policies to use these
criteria. If you configure identity policies to establish user identity based on source IP address,
you can control access based on username or user group membership. By controlling access
based on user identity, you can apply the appropriate access controls whether the user changes
workstations or obtains a different address through DHCP. If you base rules on group
membership, user network access changes as users change roles in your organization, moving
from one group to another.

Intrusion Policy—Select Intrusion Policy > On and select the intrusion inspection policy to
inspect traffic for intrusions and exploits. Use intrusion policies as a last line of defense against
unwanted traffic that you are otherwise allowing. An intrusion policy examines decoded
packets for intrusions, exploits, and other attacks based on patterns, and can block or alter
malicious traffic. Cisco delivers several intrusion policies with the Firepower system.
File Policy- Use file policies to detect malicious software, or malware, using Advanced Malware
Protection for Firepower (AMP for Firepower). You can also use file policies to perform file
control, which allows control over all files of a specific type regardless of whether the files
contain malware.

Logging-The logging settings for an access rule determine whether connection events are
issued for traffic that matches the rule. You must enable logging to see events related to the
rule in the Event Viewer. You must also enable logging for matching traffic to be reflected in the
various dashboards you can use to monitor the system.
Log at Beginning and End of Connection—Issue events at the start and end of a connection.
Log at End of Connection—Select this option if you want to enable connection logging at the
end of the connection, which is recommended for allowed or trusted traffic.
No Logging at Connection—Select this option to disable logging for the rule. This is the default.

18-Access Control Policy

Uploaded by

Copyright:

Available Formats

18-Access Control Policy

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

18-Access Control Policy

Uploaded by

Copyright:

Available Formats

Access Control Policy:

Trust Allow traffic without further inspection of any kind.

1 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 056 430 3717

2 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 056 430 3717

3 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 056 430 3717

4 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 056 430 3717

5 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 056 430 3717

You might also like