Cisco Cisco Firepower Management Center 4000

You have two choices, depending on whether 

under Transport/Network Layer 

Preprocessors is enabled:

If the configuration is enabled, click 

.

If the configuration is disabled, click 

, then click 

.

The Packet Decoding page appears. A message at the bottom of the page identifies the intrusion policy 
layer that contains the configuration. See 

 for more 

information.

You can enable or disable any of the detection options on the Packet Decoding page. See 

 for more information.

Optionally, click 

at the top of the page to display rules associated with 

individual options.

Click 

 to return to the Packet Decoding page.

Save your policy, continue editing, discard your changes, revert to the default configuration settings in 
the base policy, or exit while leaving your changes in the system cache. See the 

 table for more information.

Protection

The TCP protocol defines various states in which connections can exist. Each TCP connection is 
identified by the source and destination IP addresses and source and destination ports. TCP permits only 
one connection with the same connection parameter values to exist at a time. 

Note that you must enable TCP stream preprocessor rules, which have a generator ID (GID) of 129, if 
you want these rules to generate events. A link on the configuration page takes you to a filtered view of 
TCP stream preprocessor rules on the intrusion policy Rules page, where you can enable and disable 
rules and configure other rule actions. See 

 for more information.

Note also that when a rule that requires this preprocessor is enabled in an intrusion policy, you must 
enable the preprocessor or choose to allow the system to enable it automatically before you can save the 
policy. For more information, see 

If you enable any of the following, TCP stream preprocessing must be enabled:

the DCE/RPC preprocessor when the RPC over HTTP proxy, RPC over HTTP server, TCP, or SMB 
transport protocol is selected 

the DNS preprocessor

the FTP/Telnet preprocessor

the HTTP Inspect preprocessor

the IMAP preprocessor

the POP preprocessor

the SMTP preprocessor 

the SSL preprocessor

the Modbus preprocessor

the DNP3 preprocessor