Symptom

When using an Access Control Policy (ACP) with only a default action (no rules) and the ACP is in the Global domain while the device is in a child domain, the system support firewall-engine-debug output shows very little info. > system support firewall-engine-debug Please specify an IP protocol: tcp Please specify a client IP address: Please specify a client port: Please specify a server IP address: Please specify a server port: Monitoring firewall engine debug messages 192.0.2.5 52732 -> 192.0.2.50 80 6 AS=0 ID=26 GR=1-1 InsightUrlListEventHandler: No active URL entries 192.0.2' repeated 1 times, suppressed by syslog-ng on firepower Connection closure: 192.0.2.5 52732 -> 192.0.2.50 80 6 AS=0 ID=26 GR=1-1 Got end of flow event from hardware with flags 00000000 192.0.2.5 52732 -> 192.0.2.50 80 6 AS=0 ID=26 GR=1-1 Rule Match Data: rule_id 0, rule_action 0 rev_id 0, rule_flags 0 With Snort2 the above output is completely empty. While after adding one rule the debug output shows much more info as expected: 192.0.2.5 52730 -> 192.0.2.50 80 6 AS=0 ID=17 GR=1-1 New firewall session 192.0.2.5 52730 -> 192.0.2.50 80 6 AS=0 ID=17 GR=1-1 app event with client no change, service no change, payload no change, referred no change, misc no change, url no change, tls host no change, bits 0x1 192.0.2.5 52730 -> 192.0.2.50 80 6 AS=0 ID=17 GR=1-1 using HW or preset rule order 2, 'New-Rule-#1-ALLOW', action Allow and prefilter rule 0 192.0.2.5 52730 -> 192.0.2.50 80 6 AS=0 ID=17 GR=1-1 allow action 192.0.2.5 52730 -> 192.0.2.50 80 6 AS=0 ID=17 GR=1-1 InsightUrlListEventHandler: No active URL entries 192.0.2' repeated 1 times, suppressed by syslog-ng on firepower The above should be documented in the FTD Command Reference.

Conditions

When the ACP is empty with default as (e.g., Balanced Security and Connectivity) and in Policies -> Access Control -> Policy Editor -> Advanced Settings, "Intrusion Policy used before Access Control rule is determined " is also the same (e.g., Balanced Security and Connectivity) , firewall evaluation is not required. Thus, the output of the 'system support firewall-engine-debug' is empty (or shows only 1 line).

Workaround

Further Problem Description