Cisco Secure Firewall: AI assistant (LLM)

Paste this into your AI assistant to have it help configure Cisco Secure Firewall (FTD) to allow the RTA's outbound connection. It still pauses for your confirmation and for anything your version does differently.

Configuration prompt

You are helping me configure my Cisco Secure Firewall (FTD, managed by FMC/FDM) so
the Sophos Remote Testing Appliance (RTA) can reach its endpoint. Work through the
steps in order and show me the pending change before I deploy anything.

CONTEXT:
- The RTA makes one outbound connection: OpenVPN over TCP/443 to
  connect.remotetesting.secureworks.com. This resolves to two static IP addresses,
  3.33.194.251 and 15.197.255.2, that do not change.
- Two things commonly block it: an SSL/TLS decryption policy that intercepts
  port-443 traffic and resets the OpenVPN session, and application detection (the
  Snort inspection engine / AppID) that classifies the flow as OpenVPN or
  non-standard SSL on 443 and drops it.
- Some appliances also register over standard HTTPS on TCP/443 to
  get.remotetesting.secureworks.com. Allow that destination by FQDN (its IP
  addresses are not static) and exempt it from decryption.

STEPS:
1. Create the network object. In FMC, go to Objects > Object Management > Network,
   then Add Network > Add Object. Name it rta-connect-endpoint, set Type to FQDN,
   and set the FQDN to connect.remotetesting.secureworks.com. Save. Note that FQDN
   objects can be used in Access Control Policy rules but not in Prefilter Policy
   rules.
2. Add a Do-Not-Decrypt rule. Go to Policies > SSL (FMC 6.x) or
   Policies > Decryption (FMC 7.x and later) and open the SSL/Decryption Policy
   applied to the interface pair carrying RTA traffic. Add a rule at the top of the
   rule list with Action set to Do Not Decrypt, Destination Networks set to the
   rta-connect-endpoint FQDN object, and Destination Port TCP/443. Place it above
   any catch-all decrypt rules, because FMC evaluates rules top-down and a decrypt
   rule that matches first is never overridden.
3. Allow the flow. Use one of two options.
   - Option A (recommended): Prefilter Fastpath. Go to Policies > Prefilter and
     open the Prefilter Policy applied to the relevant device or interface pair.
     Add a Prefilter Rule with Action Fastpath, Destination Networks 3.33.194.251
     and 15.197.255.2, Destination Port TCP/443, and Direction Any (or
     Initiator-to-Responder if your policy permits). Prefilter rules match by IP
     and port only, so the FQDN object cannot be used here; use the two static IPs.
     Fastpath bypasses Snort and all L7 inspection, and it also bypasses the
     decryption engine, so if you use this option the Do-Not-Decrypt rule in step 2
     is not required for this flow. Move the rule above any block rules for the
     same port range.
   - Option B: Access Control Policy allow rule. Go to Policies > Access Control
     and open the Access Control Policy applied to the device. Add a rule with
     Action Allow, Destination Networks set to rta-connect-endpoint, and
     Destination Port TCP/443. On the rule's Inspection tab, set Intrusion Policy
     to None so Snort does not evaluate and drop the flow. Place this rule above
     any application-based block rules that match OpenVPN or unclassified-on-443
     traffic.
   - AppID caveat: AppID may classify this flow as OpenVPN even with an allow
     action. If a separate rule blocks the OpenVPN application, the allow rule must
     be ordered before it. Disabling the intrusion policy on the allow rule
     (Option B) also removes Snort's opportunity to reset the session on
     application identification.
4. Deploy the change. All policy changes in FMC are staged until explicitly pushed
   to the device. Click Deploy > Deployment in the top navigation bar, select the
   target FTD device or devices, and click Deploy. Show me the staged changes
   before you deploy.

VERIFY:
- From a host on the same network segment as the RTA, run:
  nc -vz connect.remotetesting.secureworks.com 443
  A success looks like: Connection to connect.remotetesting.secureworks.com port
  443 [tcp/https] succeeded!
- Confirm the RTA establishes and holds its OpenVPN tunnel, and that the connection
  stays stable rather than resetting within a few seconds.
- In FMC, go to Analysis > Connections > Events and filter on Destination Hostname
  connect.remotetesting.secureworks.com and Destination Port 443. Confirm the
  action is Allow, or Fastpath if the Prefilter rule fired, and that no subsequent
  blocks appear for the same flow.

RULES YOU MUST FOLLOW:
- These steps are authoritative. If a menu, command, or option does not match what
  is written here (versions differ), STOP and show me what you actually see. Do not
  guess at equivalent settings or invent CLI syntax.
- Make the narrowest change that allows this one destination. Do not broaden an
  existing rule to "any", and do not disable, bypass, or pause the firewall, TLS/SSL
  decryption, or threat inspection globally to make it work.
- Allowlist connect.remotetesting.secureworks.com. Its two IPs (3.33.194.251 and
  15.197.255.2) are static, but get.remotetesting.secureworks.com (used on some
  platforms) is not, so allow that one BY FQDN, never by a hardcoded IP.
- Do not apply, commit, or deploy the change until I confirm. Show me the pending
  configuration first.
- Change only what these steps describe. Do not alter unrelated rules, objects, or
  policy, and do not touch anything outside allowing this destination.