Cisco Cisco Firepower Management Center 4000

Note that you cannot modify the setting for 

 in the default profile. The default profile applies 

to all client hosts on your network that are not identified in another profile.

Specify, in bytes, the maximum length of responses from the FTP client in the 

 

field. 

To detect FTP bounce attacks, select 

.

The FTP/Telnet decoder detects when an FTP PORT command is issued and the specified host does 
not match the specified host of the client. 

To configure a list of additional hosts and ports where FTP PORT commands should not be treated 
as FTP bounce attacks, specify each host (or network in CIDR format) followed by a colon (:) and 
the port or port range in the 

 field. To enter a range of ports for a host, separate 

the beginning port in the range and the final port in the range with a dash (-). You can enter multiple 
hosts by separating the entries for the hosts with a comma.

For example, to permit FTP PORT commands directed to the host 192.168.1.1 at port 21 and 
commands directed to the host 192.168.1.2 at any of the ports from 22 to 1024, type:

192.168.1.1:21, 192.168.1.2:22-1024

For information on using CIDR notation and prefix lengths in the FireSIGHT System, see 

.

To specify multiple individual ports for a host, you must repeat the host IP address for each port 
definition. For example, to specify the ports 22 and 25 on 192.168.1.1, type 

192.168.1.1:22, 

192.168.1.1:25

.

To detect when telnet commands are used over the FTP command channel, select 

.

To ignore telnet character and line erase commands when normalizing FTP traffic, select 

.

Optionally, click 

 at the top of the page to display rules 

associated with individual options.

Click 

 to return to the FTP and Telnet Configuration page.

Save your policy, continue editing, discard your changes, revert to the default configuration settings in 
the base policy, or exit while leaving your changes in the system cache. See the 

 table for more information.

Protection

The HTTP Inspect preprocessor is responsible for:

decoding and normalizing HTTP requests sent to and HTTP responses received from web servers 
on your network

separating messages sent to web servers into URI, non-cookie header, cookie header, method, and 
message body components to improve performance of HTTP-related intrusion rules