Cisco Cisco Firepower Management Center 4000

For more information on configuring the other options on this page, see 

Optionally, you can modify any of the following under 

:

Select 

to examine reassembled TCP streams containing FTP packets. Clear 

 to inspect only unreassembled packets.

If you disable 

in an intrusion policy (not recommended), FTP and telnet 

processing becomes implicitly stateless even if you select 

 here, because the TCP layer 

does not pass on any state information. You can determine whether TCP Stream Configuration is enabled 
by expanding Advanced Settings on the left side of the page; TCP Stream Configuration is enabled if it 
appears as a sublink beneath Advanced Settings. For more information on stateful inspection and stream 
reassembly settings, see 

Select 

to detect encrypted traffic. Clear 

 to ignore 

encrypted traffic.

If needed, select 

 to continue checking a stream after it becomes 

encrypted, in case it becomes decrypted again and can be processed.

Optionally, click 

at the top of the page to display rules 

associated with individual options.

Click 

 to return to the FTP and Telnet Configuration page.

Save your policy, continue editing, discard your changes, revert to the default configuration settings in 
the base policy, or exit while leaving your changes in the system cache. See the 

 table for more information.

Protection

You can enable or disable normalization of telnet commands by the FTP/Telnet decoder, enable or 
disable a specific anomaly case, and set the threshold number of Are You There (AYT) attacks to permit.

If no preprocessor rule is mentioned, the option is not associated with a preprocessor rule.

Indicates the ports whose telnet traffic you want to normalize. In the interface, list multiple ports 
separated by commas.

Any port you add to the telnet 

 list should also be added in each TCP policy to the 

appropriate list of TCP reassembly ports, depending on whether you are monitoring client 
or server traffic, or both. Note, however, that reassembling additional traffic types (client, 
server, both) increases resource demands. For more information on configuring TCP 
reassembly ports, see 

.