Cisco Cisco Firepower Management Center 4000

enable and specify auto-detection ports. See 

 for 

more information.

set the preprocessor to detect when there is an attempt to connect to one or more shared SMB 
resources that you identify. 

configure the preprocessor to detect files in SMB traffic, and to inspect a specified number of bytes 
in a detected file. 

modify an advanced option that should be modified only by a user with SMB protocol expertise; this 
option lets you set the preprocessor to detect when a number of chained SMB AndX commands 
exceed a specified maximum number.

Note that you can enable the 

 global option to automatically override the 

policy type configured for a targeted policy on a per session basis when SMB is the DCE/RPC transport. 
See 

.

In addition to enabling SMB traffic file detection in the DCE/RPC preprocessor, you can configure a file 
policy to optionally capture and block these files, or submit them to the Collective Security Intelligence 
Cloud for dynamic analysis. Within that policy, you must create a file rule with an 

 of 

 

or 

 and a selected 

 of 

 or 

. See 

 for more information.

Protection

In each target-based policy, you can enable one or more of the TCP, UDP, SMB, and RPC over HTTP 
transports. When you enable a transport, you must also specify one or more detection ports, that is, ports 
that are known to carry DCE/RPC traffic. Optionally, you can also enable and specify auto-detection 
ports, that is, ports that the preprocessor tests first to determine if they carry DCE/RPC traffic and 
continues processing only when it detects DCE/RPC traffic.

Cisco recommends that you use the default detection ports, which are either well-known ports or 
otherwise commonly-used ports for each protocol. You would add detection ports only if you detected 
DCE/RPC traffic on a non-default port.

When you enable auto-detection ports, ensure that they are set to the port range from 1024 to 65535 to 
cover the entire ephemeral port range. Note that it is unlikely that you would enable or specify 
auto-detection ports for the RPC over HTTP Proxy Auto-Detect Ports option or the SMB Auto-Detect 
Ports option because there is little likelihood that traffic for either would occur or even be possible except 
on the specified default detection ports. Note also that auto-detection occurs only for ports not already 
identified by transport detection ports. See 

for recommendations for enabling or disabling auto-detection ports for each transport.

Note that any port configured for the 

or 

 option is automatically activated 

as a TCP stream preprocessor client or server reassembly port for the duration of a DCE/RPC session 
over the configured TCP port. Only TCP ports are activated, and TCP ports are automatically deactivated 
at the end of the session. See 

 and 

 for more information.

You can specify ports for one or more transports in any combination in a Windows target-based policy 
to match the traffic on your network, but you can only specify ports for the SMB transport in a Samba 
target-based policy.