Access Control and Prefilter Policies
This domain tests rule ordering and the division of labor between prefilter and access control. You must know which policy sees a packet first and which actions skip inspection.
Prefilter policy
- Prefilter is the first policy evaluated. Its rules can Tunnel (decrypt for further inspection), Block, Allow, or Fastpath.
- Fastpath bypasses access control and Snort inspection. It is intended for trusted traffic that does not need deep inspection.
- The default prefilter action is either Analyze, which sends unmatched traffic to access control, or Block.
- Prefilter rules commonly match GRE, IPsec, or other tunnel traffic that must be handled before access control.
Access control policy
- Access control rules are evaluated top-down; the first match wins. Put specific rules above general rules.
- Rule conditions include source and destination zones, networks, geolocation, VLAN tags, ports, applications, URLs, users, and Security Group Tags from ISE.
- Actions are Allow, Block, Trust, Monitor, Interactive Block, and Block with Reset.
- Trust bypasses intrusion, file, and malware inspection. Allow can attach SSL, intrusion, file, and malware policies. Monitor logs without blocking.
- The default action applies to unmatched traffic and is usually Block; logging is not automatic unless enabled.
Worked example
Rule 1 allows inside-to-outside HTTPS for 10.1.0.0/16 with an intrusion and file policy. Rule 2 blocks all other inside-to-outside traffic. A user at 10.1.5.20 visits https://example.com. The flow matches Rule 1, is inspected by Snort, and file downloads are checked. A user on the same subnet connects to an unusual high port; no application match occurs, so the flow falls to Rule 2 and is blocked. If Rule 2 were placed first, the HTTPS traffic would never reach Rule 1 because the first match wins.
Traps that cost marks
- Placing a broad Block rule above a specific Allow rule.
- Using Trust when inspection is required.
- Expecting Fastpath traffic to generate intrusion or file events.
- Forgetting that URL filtering needs the URL license and category data.
- Assuming the default action logs by default.