Sunday, October 6, 2019

Recommendation for developing baseline firepower Access Control rules based ONLY on logs from Firepower Management Center (FMC)

Hi all, we recently deployed some firewalls in a client's network which was initally an "open" network.

Based on the design of these new firewalls put in place to implement proper segmentation, I have been tasked with developing baseline firewalls rules.

Because the network was initially open, there is no way I could possily use any existing rules. Plus getting the expected traffic flow information for each zone from the relevant teams of the client is not possible for unknown reasons. They do not have that sort of visibility.

So, the responsibility is all upon me to somehow develop this baseline firewall rules based on just looking at the traffic logs! You can imagine how this can be a humongous task.

Hence, I am wondering if there is any better, more efficient and faster way to do this ? I dont want to go through the logs line by line to determine what firewall rule should I create ?

Does anyone know if there's any such feature or dashboard/report in FMC where I can get the visibility of the high traffic patterns from all zones, which can eventually help me build this firewall policy ?

For e.g a list of traffic flows which tells me there is high amount of traffic between zone A to zone B and so on.



No comments:

Post a Comment