Maximising Threat Ecacy and

Optimising Performance of Cisco

Firepower™ Threat Defense
Sumit Bist
Technical Solutions Architect

BRKSEC-2494
Cisco Webex Teams

Questions?
Use Cisco Webex Teams to chat
with the speaker after the session

How
1 Find this session in the Cisco Events Mobile App
2 Click “Join the Discussion”
3 Install Webex Teams or go directly to the team space
4 Enter messages/questions in the team space

BRKSEC-2494 © 2020 Cisco and/or its aliates. All rights reserved. Cisco Public 3
 Firepower Diagonal Learning Map Thursday BRKSEC-2034 -14h45
Cloud Management of Firepower
and ASA with Cisco Defense
BRKSEC 3629 – 14h45 Orchestrator
Designing IPSec VPNs with Firepower Threat
Monday – 8h30 Defense integration for Scale and High Availability
TECSEC-2600
Next Generation Firewall Platforms and
Integrations
BRKSEC-2056 – 9h45 Friday
TECSEC-3004 Threat Centric Network
Troubleshooting Firepower Threat Security
Defense like a TAC Engineer PSOSEC-4905 - 13h30
The Future of the
Firewall BRKSEC-3035 – 8h30
Firepower Platforms Deep Dive

BRKSEC-3328 – 11h00 BRKSEC-3093 - 14h45

Making Firepower Management ARM yourself using
Center (FMC) Do More NGFWv in AZUR
BRKSEC-3300 – 9h00
Thursday
Advanced IPS Deployment
BRKSEC 2348 – 17h00 with Firepower NGFW
Deploying AC with FP – posture & MFA
BRKSEC-2140 – 9h00
2 birds with 1 stone: Duo
Wednesday integration with Cisco ISE and
BRKSEC 2020 – 11h00 Firewall solutions
Deploying FP Tips and Tricks BRKSEC-3455 – 11h15
Dissecting Firepower NGFW:
Architecture and Troubleshooting
Tuesday BRKSEC 2494 – 8h30
Maximizing Threat Efficacy & BRKSEC-3032 – 11h30
Firepower NGFW
Performance
BRKSEC-2663 -16h45 Clustering Deep Dive

BRKSEC 3063 - 14h30 DDoS Mitigation: Introducing Radware Deployment

Decrypting the Internet with Firepower!

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 4
Your Speaker

Sumit Bist
[email protected]
Solutions Architect

• 8 years Experience with TAC

• 5+ years Experience with Firepower

• Core Architect for Security Experience Center

• Security Evangelist @University/College

BRKSEC-2494 © 2020 Cisco and/or its aliates. All rights reserved. Cisco Public 5
Agenda
• Introduction
• Performance Testing-101
• Best Practices
• Demo

• Threat Efficacy Testing

• Best Practices
• Demo

• Conclusion
• Session Takeaways

BRKSEC-2494 © 2020 Cisco and/or its aliates. All rights reserved. Cisco Public 6
Session Objectives

• Test Drive your NGFW

• To acquire necessary knowledge, techniques on evaluating and

benchmarking Cisco Firepower Threat Defense Platforms.

• Learn best practices valuable for both testing and production

environments.

• Guidance to sizing NGFW

BRKSEC-2494 © 2020 Cisco and/or its aliates. All rights reserved. Cisco Public 7
 Introduction – Key Terminology
These terms are within the context of Firepower Threat Defense.
Term Definition

FTD Firepower Threat Defense – unified software image (ASA + Firepower)

Lina Underlying ASA-derived process that is integrated into the FTD product

Snort Components of the Firepower product integrated into FTD

FMC Firepower Management Center – Off-box GUI used to manage FTD devices
(Configuration, reporting, monitoring, etc.)

FXOS Firepower Extensible Operating System – System that manages the hardware
platforms for Firepower 9300, 4100, and 2100 series products

BRKSEC-2494 © 2020 Cisco and/or its aliates. All rights reserved. Cisco Public 8
 Introduction – Key Terminology
These terms are within the context of Performance & Threat Efficacy Testing .
Term Definition

DUT Device Under Test

CPS New connections per Second

Maximum Open Maximum number of concurrent/open connections on device

Connections
IMIX/EMIX Internet Mix or Enterprise traffic consisting of varying packet
sizes, services and applications
Security/Threat Efficacy Security effectiveness, coverage and accuracy

POV or POC Proof of Value/Proof of Concept

BRKSEC-2494 © 2020 Cisco and/or its aliates. All rights reserved. Cisco Public 9
 Introduction – What is Firepower Threat
Defense?
• ASA and Firepower
functionality wrapped into a
single, unified image
ASA Firepower
(Lina) (Snort)
• All processes run within single
operating system

• Latest hardware platforms

introduce Firepower Extensible
Operating System (FXOS) as
FTD
FXOS
wrapper around FTD
application
FXOS

BRKSEC-2494 © 2020 Cisco and/or its aliates. All rights reserved. Cisco Public 10
Firepower Threat Defense - Functional Diagram

Platform (Virtual, FPR 1100, 2100, 4100, 9300)

Lina Internal, DMA-based packet transport system

Physical
Layer,
Interface
allocation,
HW
ARP, NAT,
Routing, L3 Snort
redundancy ACLs, TCP
State AppID, URL Filtering, IPS, SSL Decryption, User
Checking Awareness, Geolocation, Security Intelligence

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 11
Performance Testing-101
Performance Testing 101

• Performance Basics
• Types of Performance benchmarks
• Influencing factors
• Performance Tuning
• Best Practices

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 13
Performance Basics

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 14
Lina vs Snort Overview

OSI Layer Component Examples

L1 - Physical FXOS, 5500-X, Virtual platforms Interface allocation, L1
configuration
L2 - Data Link Lina Interface MAC Addressing,
(FXOS handles LACP on Firepower ARP
platforms - 2100, 4100, 9300)
L3 - Network Lina IP Address assignment,
Routing, NAT
L4 - Transport Lina TCP State checking, L4 ACLs

L5-7 - Session, Snort AppID, URL Filtering, IPS, SSL

Presentation, and (Lina L7 inspection via Modular Decryption, User Awareness
Application Layers Policy Framework (MPF))

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 15
 Types of Performance benchmarks

Objective Connection profile

Data delivered over a Optimum connection rate
Maximum Throughput period of time

Maximum Connections Maximum new connections Short-lived connections with

per second per second low bandwidth

Maximum number of Long lived ows with low to

Maximum Concurrent
open/existing connections mid bandwidth
connections

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 16
The World of Testing tools

• Industry standard (licensed) • Freeware (Open Source)

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 17
Performance Factors

• Elephant Flows
CPU • Load Distribution
• Connections per second

Memory

Throughput

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 18
Performance Factors

CPU

• Number of policies/rules
Memory • Maximum active connections

Throughput

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 19
Performance Factors

CPU

Memory • Type of Traffic (HTTP vs EMIX)

• Features Enabled (SSL Decryption,
IPS, AMP)
Throughput • Availability of free CPU cores and
memory

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 20
Performance Tuning
Agenda
Increase in
Average Packet size
Average
Object size Packet size
SSL Record size
Delayed Ack Increase in
Throughput
Load/Connection Ramp-up Profile

Load-distribution

Long persistent flows

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 22
Performance Tuning
Average Packet size

• Each “person” in elevator consumes different amount of space.

• Unfortunately they don’t look like this:

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 23
Performance Tuning
Average Packet size

• Typical packet length distribution

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 24
Performance Tuning

Object size
SSL • Application data sent in response
Record to GET request
Object Size
size

SSL Record Size

Delayed
Ack
• Application data delivered via TLS

Delayed Ack
• Combines several Ack responses
into one.
Average Packet size
BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 25
Performance Tuning
HTTP object size

• Application data sent in response to GET request

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 26
Performance Tuning

SSL Record size

• Application data delivered via TLS

• Maximum TLS record size: 214 bytes i.e. ~16KB

Sample : Average packet size vs Record size

SSL Record Size Observed Average packet size

410 bytes ~512 bytes
1460 bytes ~765 bytes
2200 bytes ~1024 bytes

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 27
Performance Tuning

Delayed Ack

• Reduces protocol overhead by reducing number of ACKs

• Results in higher Average packet size thereby increasing overall Throughput

Sample: Delayed Ack tuning

Send Ack after every 4
segments
(Receive Window÷MSS)

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 28
Performance Tuning
Load/Connection Ramp-up Profile

• Short connection ramp-up time may create traffic bursts when testing with
small packet size.
• It may result into interface oversubscription on DUT.
Max Sessions

Data Rate
Sessions Per Second

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 29
Performance Tuning
Load/Connection Ramp-up Profile

• Follow Stairstep approach for Load profile

• Increment ‘n’ connections per interval
Max Sessions

Data Rate
Sessions Per Second

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 30
 Performance Tuning
Load-distribution on CPU cores

• Maintain even load-balancing of flows to cpu cores

• Follow 5-tuple rule
> show asp inspect-dp snort
SNORT Inspect Instance Status Info

Id Pid Cpu-Usage Conns Segs/Pkts Status

tot (usr | sys)
-- ----- ---------------- ---------- ---------- ----------
Inspection
0 89776 71% ( 71%| 0%) 14 0 READY
Load 1 89775 70% ( 70%| 0%) 24 0 READY
[..]
Load 26 89801 75% ( 75%| 0%) 28 19 READY
Distribution 27 89802 72% ( 72%| 0%) 10 0 READY

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 31
 Performance Tuning
Load-distribution on Cluster Units

• Maintain even load/connection distribution on all units in FTD cluster

> show cluster info conn-distribution

Unit Total Conns (/sec) Reg Conns (/sec) Dir Conns (/sec) Fwd Conns
(/sec)
unit-1-1 12448 6218 6230 0

unit-1-2 12629 6209 6420 0

unit-1-3 12247 6235 6012 0

Even
Distribution
BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 32
Performance
Troubleshooting
 Performance Troubleshooting

Test Type Command-set DUT saturated at

Maximum show asp inspect-dp snort ASP drops show ‘snort-busy’ drops
Throughput show cpu detailed
show asp drop
CPU usage shows 100%
show resource usage ASP drops show ‘snort-busy’ drops
Maximum show cpu detailed
show asp inspect-dp snort
CPS CPU usage shows 100%
show asp drop
Maximum show resource usage ASP drops show ‘punt-no-mem’ drops
Open show asp drop
show memory
Connections Memory errors in
show blocks
show console-output

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 34
Best Practices
Baselining Your Test

Always baseline your test back to back before connecting your DUT

Wired back
to back for
baseline

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 36
 Default MSS Settings
• Ixia Breaking point does not
dynamically adjust MSS. You will
need to manually set it from 1460
to 1380 bytes
Best Practices • Cyberflood will dynamically adjust
Testing Tools MSS.

Test Tool resource utilization

• Always check CPU/memory
statistics on test tool, especially for
TLS throughput test

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 37
 There is no MAX All test, break it
down into separate test cases.

Clear the residual connections

Best Practices using “clear connection” from
FTD CLI, after every test run

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 38
Best Practices
• Tune sub-optimal logging
• Especially applicable to Maximum new connections per second test

Disable

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 39
Best Practices
• Small average size packets with high input rate (micro-bursts) may lead to interface
oversubscription (overrun, no buffer drops)
• Tune average packet size and connection ramp-up rate.

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 40
 Create Trust/Prefilter/IAB rules for:

YouTube or any video and music

streaming apps

Best Practices
Elephant flows – e.g. Database
sync operations

VoIP protocols

East-West traffic
BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 41
 Smart Inspection
Tune AMP/File policy’s direction of file
transfer

Best Practices Select only file types which needs

inspection

If TLS decryption is not being used, do

not enable AMP/File inspection for
SSL/TLS traffic.
BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 42
 Early Detection
Rules with known parameters (5 tuples,
URLs, Users, SGT tags, VLAN tags)
should be configured be at the top of
rule order

Best Practices Rules configured with Application

detectors takes more Rule evaluation
time than rules with known parameters

For e.g: For an internal DNS server,

consider creating a rule with UDP port
53 instead of DNS application

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 43
Demo: Recreating Data Sheet Numbers
Recreating Data Sheet Numbers – FPR4115

Datasheet Reference: http://cs.co/90071dan7

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 45
Recreating Maximum Connections per Second
Preconditions to Test Any-Any
Allow rule
• Access-Policy

• Traffic Profile: HTTP only

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 46
Recreating Maximum TLS Throughput
Preconditions to Test

• SSL version: TLS 1.2, RSA key: 2048 bit, Cipher suite: TLS_RSA_AES256_SHA
• Traffic Profile: 50% TLS, 50% HTTP Any-Any
Allow rule
• Access-Policy

• SSL Policy: Decrypt Resign

• SSL Record Size: 1460 bytes
• Session Reuse
BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 47
Threat Efficacy Testing
How is it different?

Real World Traffic Test Tool Traffic

Accurate host profile Host profile might change with

each exploit run

Use Firepower Rule Firepower Rule

Recommendations for further Recommendations is not reliable
tuning

For an in-depth discussion of IPS tuning,

see Gary Halleen’s BRKSEC-3300 session.

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 49
Inaccurate Host Profile

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 50
IXIA Strike Testing Overview

• Strikes are usually based off common vulnerabilities (CVE’s) and exploits

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 51
IXIA Strike Testing Overview

• Advanced Fuzz Testing: Strike Variants using Evasion Profile

• Covers multiple exploit versions of a strike.

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 52
Best Practices
 Application Protocol fixup (lina)
Application inspection on lina side
might lead to traffic drops, thus
hampering test results.

Best Practices Disable fixup protocol fixups from

FTD CLI, for e.g:

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 54
 Always use latest SRU/VDB
packages installed for the
most recent Snort IPS Rules
Set and Vulnerability Database
Best Practices
As older rules become
irrelevant, they can be
FMC  Security Updates disabled in a more recent SRU

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 55
 For efficacy/strike testing with Ixia
Breaking point, always use :
• HOME_NET  ANY
• EXTERNAL_NET  ANY

Best Practices
FMC  Variable Sets

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 56
 Some of the Ixia strike lists might
contain malware content, in addition
to exploits

Configure an AMP policy to block

Best Practices malware.

FMC  AMP/File Policy

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 57
Demo: Efficacy Testing
Efficacy testing using IXIA Breaking point
Preconditions to Test

• Set IPS policy to Maximum Detection

• Set Network Analysis Policy to Maximum Detection
• Create a Malware Policy

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 59
Conclusion
 What did we learn?

Bigger object size

Delayed ACK configured
Even Load Distribution
Longer flows (multiple GETs on a single persistent connection)
Larger Average packet size

Higher Throughput
BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 61
Session Takeaways
Session Takeaways
Data points to collect before starting a sizing estimation
• Traffic mix
• Average packet size
• Average CPS numbers
• Enabled features
• An estimate of the average number of rules
• Amount of logging on rules
• Amount of SSL Traffic needing decryption

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 63
Session Takeaways

• Repeat the Performance/Throughput tests with a more realistic (close to

production) Average packet size and Traffic profile.
• ASA or Firepower customers can use “show traffic” command to find
Average packet size

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 64
Session Takeaways
Existing Firepower customers can leverage FMC Dashboard Reporting to
understand the Applications and traffic profile in their network.

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 65
Session Takeaways
• Use Netflow to figure out Traffic profile
• Sample from Stealthwatch as a Netflow collector:

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 66
We can help you

Assisted POVs (Global)

• POVaaS - Firepower vPods in dCloud
• Performance, Threat efficacy & Functional testing
• Custom scripting
POV
Assistance

Customer/Partners can request engagement

by contacting their GSSO TSA’s
BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 67
 Firepower Diagonal Learning Map Thursday BRKSEC-2034
Cloud Management of Firepower and ASA
with Cisco Defense Orchestrator
BRKSEC 3629
Designing IPSec VPNs with Firepower Threat Defense
Monday integration for Scale and High Availability
TECSEC-2600 – for beginners
Next Generation Firewall Platforms and Friday
Integrations
TECSEC-3004 – for existing customers BRKSEC-3035
Troubleshooting Firepower Threat Firepower Platforms Deep Dive
Defense like a TAC Engineer
BRKSEC-2056
Threat Centric Network Security

BRKSEC-3328 BRKSEC-3093
Making Firepower Management ARM yourself using NGFWv
Center (FMC) Do More in AZUR

Thursday BRKSEC-3300
Advanced IPS Deployment
BRKSEC 2348
with Firepower NGFW
Deploying AC with FP

Friday BRKSEC-2140
2 birds with 1 stone: DUO
BRKSEC 2020 Wednesday integration with Cisco ISE and
Deploying FP Tips and Tricks Firewall solutions
BRKSEC-3455
Dissecting Firepower NGFW:
Architecture and Troubleshooting
Tuesday
BRKSEC 2494 BRKSEC-3032
Maximizing Threat Efficacy & Perf Firepower NGFW Clustering
Deep Dive
BRKSEC-2663
BRKSEC 3036 DDoS Mitigation: Introducing Radware Deployment
Decrypting the Internet with Firepower!

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 68
Complete your
online session
survey • Please complete your session survey
after each session. Your feedback
is very important.
• Complete a minimum of 4 session
surveys and the Overall Conference
survey (starting on Thursday) to
receive your Cisco Live t-shirt.
• All surveys can be taken in the Cisco Events
Mobile App or by logging in to the Content
Catalog on ciscolive.com/emea.

Cisco Live sessions will be available for viewing on

demand after the event at ciscolive.com.

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 70
Continue your education

Demos in the
Walk-In Labs
Cisco Showcase

Meet the Engineer

Related sessions
1:1 meetings

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 71
Thank you
Appendix
NIC Performance Considerations

• If ingress FIFO is full, frames are dropped

• No free slots in RX ring (CPU/memory bound)
• No buffer on memory move errors, overrun on FIFO drops

• FIFO is not affected by packet rates, but RX rings are

• Fixed memory block size regardless of actual frame size
• Ingress packet bursts may cause congestion even at low bits/sec

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 75
Firepower Recommendations

Can be leveraged to lists the rules whose

recommended states differ from their saved
states, before applying changes.

Include protected/inside networks

Modify Rule Overhead if there

are existing high rule overhead
signatures that needs review

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public
Better filter for Firepower Recommendations
Excerpt 1: Filter all “Drop and Generate Events” rules which will be enabled after using
recommendations.
Under Intrusion Policy:
• First click on “Disabled” under Rule State
• Then click on ”Drop and Generate Events” under Recommendation

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 77
Better filter for Firepower Recommendations
Excerpt 2: Filter all “Drop and Generate Events” rules which will be disabled after using
recommendations.
Under Intrusion Policy:
• First click on “Drop and Generate Events” under Rule State
• Then click on ”Disabled” under Recommendation

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 78
Snort - Intelligent Application Bypass

• IAB is a performance optimization tool for jumbo flows

• Invoked in a simple 2-step process:
1. Does snort exceed the ”Inspection Performance Thresholds” (high CPU, % dropped traffic, etc)?
2. If yes, then dynamically Trust flows which match “Flow Thresholds” (bytes/sec, packets/flow,
etc).
• Configured under Access Control Policy > Advanced tab

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 79
Types of Intrusion Policies

Policy CVSS Score Vulnerability Age

Connectivity over Security 10 Current year, plus 2 prior

(2019, 2018, and 2017)
Balanced Security and 9+ Current year, plus 2 prior
Connectivity Rule Categories: Malware-CNC, Blacklist, SQL
Injection, Exploit Kit
Security over Connectivity 8+ Current year, plus 3 prior
(2019, 2018, 2017, and 2016)
Rule Categories: Malware-CNC, Blacklist, SQL
Injection, Exploit Kit, App-Detect
Maximum Detection 7.5+ 2005 and later
Rule Categories: Malware-CNC, Exploit Kit

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 80
Trust Rules
• Within the Access Control Policy, defined traffic can be exempted from
File and IPS inspection, which accelerates it through the appliance.

• Security Intelligence feeds are still applied to Trust rules.

• On FP-4100/9300 appliances, a Trust rule enables Dynamic Flow Offload

on eligible flows, and handles the traffic on the HW NIC.
Not supported on Inline, Inline Tap, or Passive Interfaces.

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 81
PreFilter Policy
• PreFilter rules are processed prior to Intrusion Prevention or Access Control
Policies.

• Similar to a Trust rule, but Security Intelligence is not applied.

• On FP-4100/9300 appliances, a Fastpath rule enables Static Flow Offload on

eligible flows, and handles the traffic on the HW NIC.
Not supported on Inline, Inline Tap, or Passive interfaces.

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 82
SSL/TLS Session Reuse

• Enable/disable the capability of an SSL/TLS server to resume an

SSL/TLS session by Session ID.
• For e.g: If “Sessions before renegotiation” is configured as 5:

Full handshake -> Get new session ID, 1st use

Reuse -> #2nd use
Reuse -> #3rd use
Reuse -> #4th use
Reuse -> #5th use
Full handshake -> Get new session ID

BRKSEC-2494 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 83