I have to SFR setup on 5525-X with firesight appliance.
The default network deiscovery mode works fine, I can see the Analysis -> connection evets.
Now I want to switch to IPS inline mode by creating IPS policy called My_Policy as below
Under Policy -> intrusion policy - create new (base policy: Initial Inline Policy)
Now apply the policy by
Policies -> Access Control -> Default Network Discovery -> Edit
Here I see Admin Rules, Std rules, Root rules emty.
Default Action -> Intrusion Prevenstion: My_Policy
Log at the End of the connection
Send connection events to Defense Center - > Apply.
I have also defined
Objects - > Variable Set
Home_net (to reflects all local subnets)
external_net (exclude Home_net)
----------------------------------------
Now when I access Access Control, the polciy still remains as Network Discovery Control. It should change to My_Policy right?
Why is that Admin Rules, Std rules, Root rules are empty? Do I need to define them separately?
