Access Control Policy (ACP)
The ACP is the primary policy on FTD that determines how traffic is handled. It processes rules top-down with a first-match action. Rules can match on zones, networks, ports, applications, URLs, users, and more.
| Rule Action | Behavior | Inspection |
|---|
| Allow | Permits traffic to pass | Can apply intrusion policy, file policy, and logging |
| Trust | Permits traffic with no further inspection | Bypasses deep inspection (Snort) entirely; only prefilter applies |
| Monitor | Logs the traffic match but does not enforce | Continues to evaluate subsequent rules for enforcement |
| Block | Drops the traffic silently | No further inspection; traffic is dropped immediately |
| Block with Reset | Drops the traffic and sends a TCP RST | Notifies the client that the connection was refused |
| Interactive Block | Displays a warning page to the user (HTTP/HTTPS) | User can click through to continue; used for URL warnings |
Tip: Trust rules bypass Snort inspection entirely, which improves performance but sacrifices deep inspection. Use Trust only for traffic you are confident does not need IPS, malware, or file inspection (e.g., backup replication between trusted data centers).
Access Control Policy Processing Order
Traffic through FTD is evaluated in a specific order:
- 1. Prefilter Policy - Early handling of tunneled traffic (GRE, IP-in-IP), fastpath rules for trusted traffic, and encapsulated traffic actions
- 2. Security Intelligence - Blacklist/whitelist based on IP, URL, or DNS reputation feeds before rule evaluation
- 3. SSL/TLS Policy - Decrypt, block, or do not decrypt encrypted traffic before inspection
- 4. Identity Policy - User-to-IP mapping via Active Directory or captive portal for user-based rules
- 5. Access Control Rules - Top-down rule evaluation with match criteria and actions
- 6. Default Action - Applied when no rule matches (Block All, Trust All, Network Discovery, or Intrusion Prevention)
Prefilter Policy
Prefilter is the first policy to evaluate traffic. It handles traffic before the Snort engine processes it, making it useful for early filtering and performance optimization.
| Prefilter Action | Description |
|---|
| Fastpath | Bypasses all further inspection (Snort, ACP, file, malware). Traffic is forwarded at the hardware level for maximum throughput. |
| Analyze | Allows the traffic to continue to access control rules for normal processing. |
| Block | Drops the traffic immediately without further evaluation. |
Prefilter can match on tunneled traffic (GRE, IP-in-IP, PPTP, etc.) and apply actions to the outer or inner headers. It is also used to rezone traffic based on tunnel characteristics.
SSL/TLS Inspection Policy
SSL/TLS policies allow FTD to inspect encrypted traffic by decrypting it, analyzing the contents, and re-encrypting before forwarding. Without SSL inspection, Snort cannot see the payload of encrypted traffic.
| SSL Action | Description |
|---|
| Decrypt - Resign | FTD acts as a man-in-the-middle. Decrypts traffic using a CA certificate, inspects it, then re-encrypts with a new certificate signed by the internal CA. Used for outbound traffic. |
| Decrypt - Known Key | FTD uses the server's private key to decrypt inbound traffic. Used for inspecting traffic destined to internal servers you own. |
| Do Not Decrypt | Traffic passes encrypted without inspection. Used for sensitive traffic (banking, healthcare) or certificate-pinned applications. |
| Block | Drops the encrypted connection entirely. |
| Block with Reset | Drops the connection and sends a TCP RST to the client. |
Tip: Decrypt - Resign requires a CA certificate trusted by client machines. Deploy the internal CA certificate to all endpoints via Group Policy or MDM. Without this, users will see certificate warnings.
Identity Policy
Identity policies map IP addresses to user identities, enabling user-based and group-based access control rules. FMC integrates with identity sources to obtain this mapping.
| Identity Source | Description |
|---|
| Cisco ISE / ISE-PIC | Passive identity via pxGrid integration. Receives user-to-IP mappings from ISE authentication sessions. |
| User Agent (Deprecated) | Legacy Windows agent that monitors AD login events. Replaced by ISE-PIC. |
| Captive Portal | Active authentication via browser-based login page. Users authenticate directly through FTD. |
| Remote Access VPN | User identity obtained during VPN authentication (RADIUS attributes). |
Security Intelligence
Security Intelligence provides reputation-based filtering before access control rules are evaluated. It uses Cisco Talos threat intelligence feeds to block known malicious IPs, URLs, and DNS domains at the earliest stage.
- IP-based SI: Blocks connections to/from known malicious IP addresses (e.g., CnC servers, attackers, bogon networks)
- URL-based SI: Blocks HTTP/HTTPS requests to malicious URLs before URL filtering rules are applied
- DNS-based SI: Blocks DNS queries for known malicious domains using Cisco Umbrella or custom lists (applied via DNS policy)
- Custom Lists: Administrators can create custom blacklists and whitelists to override Talos feeds
- Global Whitelist/Blacklist: Override all other SI decisions; whitelist entries are never blocked
Tip: Security Intelligence is extremely efficient because it blocks traffic before deep packet inspection. Always enable SI feeds from Talos for the best first-line defense against known threats.
File & Malware Policy
File policies inspect files traversing the network to detect and block malware. They can be applied to access control rules with an Allow action.
| File Rule Action | Description |
|---|
| Detect Files | Logs file type and generates events but does not block. Used for visibility. |
| Block Files | Blocks specific file types regardless of malware disposition (e.g., block all .exe downloads). |
| Malware Cloud Lookup | Computes SHA-256 hash and queries Cisco AMP cloud for disposition. Logs result but does not block. |
| Block Malware | Queries AMP cloud and blocks files with a malicious disposition. This is the recommended action. |
| Malware Disposition | Meaning |
|---|
| Clean | File is known to be safe |
| Malware | File is known to be malicious |
| Unknown | File hash not found in the cloud; may require dynamic analysis (Threat Grid sandbox) |
| Custom Detection | Matches a custom SHA-256 list defined by the administrator |
| Unavailable | Cloud lookup failed (connectivity issue); file is allowed by default |
DNS Policy
DNS policies inspect DNS traffic to block queries to malicious domains. DNS rules apply Security Intelligence DNS-based feeds and custom domain lists. DNS policy actions include:
- Whitelist: Always allow DNS resolution for the matched domain
- Block (Drop): Silently drop the DNS query with no response to the client
- Block (Domain Not Found): Respond with NXDOMAIN to the client
- Block (Sinkhole): Respond with a sinkhole IP address; used to identify infected internal hosts attempting to reach CnC domains
- Monitor: Log the DNS query but take no enforcement action
Tip: DNS sinkhole is a powerful technique for identifying compromised hosts. When a client resolves a malicious domain to the sinkhole IP, any subsequent connection attempt to that IP reveals the infected host in connection events.