Cisco ASA 5506-X Configuration Manual page 369

Chapter 16 ASA FirePOWER (SFR) Module
•
•
•
•
•
•
Flow Drops:
•
•
•
Examples for the ASA FirePOWER Module
The following example diverts all HTTP traffic to the ASA FirePOWER module, and blocks all HTTP
traffic if the module fails for any reason:
hostname(config)# access-list ASASFR permit tcp any any eq 80
hostname(config)# class-map my-sfr-class
hostname(config-cmap)# match access-list ASASFR
hostname(config-cmap)# policy-map my-sfr-policy
hostname(config-pmap)# class my-sfr-class
hostname(config-pmap-c)# sfr fail-close
hostname(config-pmap-c)# service-policy my-sfr-policy global
The following example diverts all IP traffic destined for the 10.1.1.0 network and the 10.2.1.0 network
to the ASA FirePOWER module, and allows all traffic through if the module fails for any reason.
hostname(config)# access-list my-sfr-acl permit ip any 10.1.1.0 255.255.255.0
hostname(config)# access-list my-sfr-acl2 permit ip any 10.2.1.0 255.255.255.0
hostname(config)# class-map my-sfr-class
hostname(config-cmap)# match access-list my-sfr-acl
hostname(config)# class-map my-sfr-class2
hostname(config-cmap)# match access-list my-sfr-acl2
hostname(config-cmap)# policy-map my-sfr-policy
hostname(config-pmap)# class my-sfr-class
hostname(config-pmap-c)# sfr fail-open
hostname(config-pmap)# class my-sfr-class2
hostname(config-pmap-c)# sfr fail-open
hostname(config-pmap-c)# service-policy my-sfr-policy interface outside
sfr-fail—The FirePOWER configuration was removed for an existing flow and we are not able to
process it through FirePOWER it will be dropped. This should be very unlikely.
sfr-malformed-packet—The packet from FirePOWER contains an invalid header. For instance, the
header length may not be correct.
sfr-ha-request—This counter is incremented when the security appliance receives a FirePOWER HA
request packet, but could not process it and the packet is dropped.
sfr-invalid-encap—This counter is incremented when the security appliance receives a FirePOWER
packet with invalid message header, and the packet is dropped.
sfr-bad-handle-received—Received Bad flow handle in a packet from FirePOWER Module, thus
dropping flow. This counter is incremented, flow and packet are dropped on ASA as the handle for
FirePOWER flow has changed in flow duration.
sfr-rx-monitor-only—This counter is incremented when the security appliance receives a
FirePOWER packet when in monitor-only mode, and the packet is dropped.
sfr-request—The FirePOWER requested to terminate the flow. The actions bit 0 is set.
reset-by-sfr—The FirePOWER requested to terminate and reset the flow. The actions bit 1 is set.
sfr-fail-close—The flow was terminated because the card is down and the configured policy was
'fail-close'.
Examples for the ASA FirePOWER Module
Cisco ASA Series Firewall CLI Configuration Guide
16-29