Cisco Cisco Firepower Management Center 4000

This policy is built for both speed and detection. It serves as a good starting point for most 
organizations. It is also a good starting point for any type of deployment.

Connectivity Over Security

This policy is built for organizations where connectivity (being able to get to all resources) takes 
precedence over network infrastructure security. This policy enables far fewer rules than those 
enabled in the Security over Connectivity policy. Only the most critical rules that block traffic are 
enabled.

No Rules Active

All intrusion rules, preprocessors, and other configurable intrusion policy features in this policy are 
disabled by default. This policy provides a starting point if you want to create your own policy 
instead of basing it on the enabled rules and features in one of the other policies provided by Cisco. 
The system automatically enables any preprocessor required by rules you enable.

Note that all rules and most preprocessors and other advanced features are disabled in this policy.

Security Over Connectivity

This policy is built for organizations where network infrastructure security takes precedence over 
user convenience. This policy enables numerous network anomaly rules that could alert on or drop 
legitimate traffic.

You can use copies of Cisco default policies or create your own policies with tuned rule sets and 
advanced settings configurations to inspect traffic in the way that matters most to you. By doing this, 
you can improve both the performance of your managed device and your ability to respond effectively 
to the events it generates.

Note that the following initial policies, which come with your system, are custom policies provided by 
Cisco; they are not default policies:

Initial Inline Policy

Initial Passive Policy

Each of these custom policies uses a default policy as its base policy.

Protection

Custom policies include policies you create and the following two initial policies that come with your 
system:

Initial Inline Policy

Initial Passive Policy

You can use a custom policy as your base policy. Changes that you make to rules and advanced settings 
in a custom policy are automatically included in your base policy when you commit, that is, save changes 
in, the custom policy. However, you can override a default setting by modifying it in the policy that uses 
the custom policy as its base policy.

You can chain up to five custom policies, with four of the five using one of the other four previously 
created policies as its base policy; the fifth uses a default intrusion policy as its base policy.

In a custom base policy, you do not have the option of allowing rule updates to modify the base policy. 
However, in some cases importing a rule update may impact the custom base policy when the parent 
policy, that is, the original policy that you use as your custom base policy, allows rule updates to modify 
its base policy. See 

 for more information.