0

I'm currently managing a Cisco Firepower 5516X device and have encountered a false positive for a specific Snort rule. Instead of disabling the rule for all traffic, I would like to selectively exclude a single IP address from triggering this rule.

Could you please provide guidance on how to achieve this? I want to retain the rule while exempting the mentioned IP address.

Thank you for your assistance.

Improve this question
1
  • Do you mean some configuration in the firewall that sends traffic logging to a snort server? Or are you using Firepower IPS service? You might want to share some of your firewall configuration that is relevant to the issue and system in use. Generally speaking, the access list on the firewall determines which traffic is sent to the firepower module for processing so you can deny that source IP address via that ACL if you want. It will prevent that traffic from being processed by firepower.
    – FrameHowitzer
    Sep 27 at 14:23

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.