IPS Noise and an Uninspected PDF on the Guest VLAN
A company runs FTD 7.2 with FMC. The internal web server 10.70.5.20 is scanned nightly by Qualys at 10.70.9.50. The intrusion policy is tuned to Balanced Security and Connectivity, and FMC receives about 12,000 IPS events per night from the scanner, mostly web-server rules. The security team proposes disabling all web-server rule groups globally. Separately, a guest user on 10.70.30.0/24 downloads an 8 MB PDF from 203.0.113.44 over TLS 1.3. The endpoint later shows malicious behavior, but FMC has no file event for the PDF. The guest ACP rule is Allow with the IPS policy and logging; the employee ACP rule above it has a file policy with Spero and dynamic analysis. There is no TLS decryption policy. The file policy's maximum file size is set to 10 MB. The customer wants both fewer false positives and better malware visibility.
1. How should the scanner noise be handled without disabling web-server protection for real users?
Read the worked answer
Do not disable web-server rule groups globally; that removes protection for every user because the scanner is only one source. The scanner traffic is authorized and repetitive, so scope the exception. Create a separate ACP rule above the general inside rule for source 10.70.9.50 and destination 10.70.5.20, and attach a copy of the IPS policy with scanner-related web-server rules set to drop or alert disabled, or use rule exceptions. Alternatively, keep the same policy and add suppressions or thresholds for source 10.70.9.50 on the specific signatures that fire; suppress only those rules, not whole categories. Verify that the scanner is actually authorized and that its source IP is not spoofable. Review a sample of the 12,000 events to confirm they are scan signatures rather than real exploitation. After tuning, rescan and confirm event volume drops while a controlled test attack from a different source still alerts. This preserves coverage and documents the exception.
2. Why did the PDF produce no file event even though the guest rule allows traffic?
Read the worked answer
Two independent reasons explain the missing file event. First, the guest ACP rule is Allow with IPS but has no file policy attached; file inspection only occurs when the matching ACP rule references a file policy. The employee rule above it has a file policy, but guest traffic does not match that rule. Second, there is no TLS decryption policy, so the FTD cannot see the PDF inside the TLS 1.3 session even if a file policy were attached. The 8 MB size is below the 10 MB limit, so size is not the cause, though it is worth checking the file policy's supported file types. Malware events also require the file to be submitted and analyzed; without visibility, no submission occurs. The endpoint's later behavior is therefore consistent with a decrypt-and-inspect gap, not necessarily a failure of Spero or dynamic analysis. Confirm the rule hit counts and file events before changing licenses.
3. Design a test and policy change to confirm file inspection works without decrypting all guest traffic.
Read the worked answer
First attach the file policy to the guest ACP rule and add a decryption rule scoped to the guest VLAN and a controlled test destination, not all guest traffic. Use a test site you control or a supported test file such as EICAR over HTTPS; confirm the certificate chain and that the client trusts the decryption CA. Download the file and check FMC for file events, malware events, and Spero or dynamic analysis verdicts. Verify cloud connectivity and license status for file analysis; if dynamic analysis is unavailable, local malware and Spero should still produce events. Use packet captures or connection events to prove the traffic was decrypted and the file was extracted. After the test passes, expand decryption to the required categories with exceptions for privacy and unsupported applications. Document that TLS 1.3 without decryption leaves file policy blind.