Initial Device Setup
Firepower 8000 Series Getting Started Guide
14
Detection Mode
The detection mode you choose for a device determines how the system initially configures the device’s
interfaces, and whether those interfaces belong to an inline set or security zone.
The detection mode is not a setting you can change later; it is simply an option you choose during setup that
helps the system tailor the device’s initial configurations. In general, you should choose a detection mode
based on how your device is deployed:
—
Passive
- choose this mode if your device is deployed passively, as an intrusion detection system (IDS).
In a passive deployment, you can perform file and malware detection, Security Intelligence monitoring, as
well as network discovery.
—
Inline
- choose this mode if your device is deployed inline, as an intrusion prevention system. An intrusion
prevention system usually fails
open
and
allows
non-matching traffic.
In an inline deployment, you can also use AMP for Networks, file control, Security Intelligence filtering, and
network discovery.
Although you can select the inline mode for any device, keep in mind that inline sets using non-bypass
NetMods on 8000 Series devices lack bypass capability.
Note:
Reimaging resets devices in inline deployments to a non-bypass configuration; this disrupts traffic on
your network until you reconfigure bypass mode. For more information, see
Traffic Flow During the Restore
.
—
Access Control
- choose this mode if your device is deployed inline as part of an access control
deployment, that is, if you want to perform application, user, and URL control. A device configured to
perform access control usually fails
closed
and
blocks
non-matching traffic. Rules explicitly specify the
traffic to pass.
You should also choose this mode if you want to take advantage of your device’s specific hardware-based
capabilities, which include (depending on model): high availability, strict TCP enforcement, fast-path rules,
switching, routing, DHCP, NAT, and VPN.
In an access control deployment, you can also perform AMP for Networks, file control, Security Intelligence
filtering, and network discovery.
—
Network Discovery
- choose this mode if your device is deployed passively, to perform host, application,
and user discovery only.
The following table lists the interfaces, inline sets, and zones that the system creates depending on the
detection mode you choose.
Note:
Security zones are a Firepower Management Center-level configuration which the system does not create
until you actually register the device to the Firepower Management Center. Upon registration, if the appropriate
zone (Internal, External, or Passive) already exists on the Firepower Management Center, the registration process
Table 1
Initial Configurations Based on Detection Mode
Detection Mode
Security
Zones
Inline Sets
Interfaces
Inline
Internal and
External
Default Inline
Set
first pair added to Default Inline Set—one
to the Internal and one to the External
zone
Passive
Passive
none
first pair assigned to Passive zone
Access Control
none
none
none
Network Discovery
Passive
none
first pair assigned to Passive zone
