Best practices for fastpath prefiltering

When you use the fastpath action in a prefilter rule, the matching traffic bypasses inspection and is simply transmitted through the device. Use this action for traffic that you can trust and that would not benefit from any of the security features available. Some examples of traffic that you can set fastpath prefiltering for are given below.

  • VPN traffic that is going through the device. That is, the device is not an endpoint in the VPN topology.

  • SQL traffic between trusted endpoints on the internal network.

  • Scanner traffic. Scanner probes can create a lot of false-positive responses from intrusion policies.

  • Voice/video.

  • Backups.

  • Management traffic (sftunnel) that traverses Firewall Threat Defense devices. Performing deep inspection on management traffic (using access control policies) can cause issues. You can prefilter based on port TCP/8305 between the management center and managed devices.

The Threat Defense Snort engine maintains state for each traffic flow and is designed to inspect each flow exactly once. Duplicate or double inspection is unsupported when repeated traffic maps to the same Snort flow key, because the subsequent instance is associated with the existing per-flow state and may be identified as an anomaly.

This can occur when a flow re-enters the device through a different interface or VLAN, is rerouted by an ACI fabric with different VLAN tags, or traverses VRF cross-VLAN paths. The resulting drop may appear in packet-tracer or capture output as:

Drop-reason: (stream) Blocked or blacklisted by the stream preprocessor.

If a flow-identifying attribute differs such that the traffic maps to a different Snort flow key, Snort can process the flows independently. However, differences in fields that are not part of the flow key do not create a separate flow.

From an optimal network architecture perspective, each traffic flow, in both directions, should traverse the Snort engine only once. If duplicate inspection cannot be avoided, use a prefilter or fastpath rule to bypass Snort inspection for the affected flows.