Just wrapped a Firepower 1010 rollout for our 400-user remote teams. The goal was solid security with less VPN hassle. The reality? A week of weird outages.
The main breakage:
* **"Allowed" traffic blocked silently.** Our HR app kept timing out. Policy showed green, but the box dropped the packets. Turns out the 'SSL Rules' policy (separate from Access Policy!) had a default "Block Unknown" action we missed.
* **Slack calls dying at 59 minutes.** Every. Single. Time. This was a TCP idle timeout setting buried deep in the connection profile. Default was too aggressive.
* **File uploads failing for some departments.** Intrusion policies (the "IPS" part) were inspecting and resetting certain types of encrypted uploads. Had to create a more targeted rule.
Our fixes were all about tuning, not tearing down:
* Built a strict "Monitor Only" SSL policy first to see what was actually flowing.
* Created a custom connection profile for trusted SaaS IPs (like Slack) with longer timeouts.
* Used Security Intelligence whitelisting for our critical internal apps to bypass IPS during the stabilization phase.
Biggest lesson? Firepower's policies are layered. A "pass" at one layer can be a silent drop at another. Test each layer independently before going live.
~hj
Automate the boring stuff.