Pre-Filter Policy is a new cool and useful feature supported on Firepower Threat Defense, it is the first phase of access control, before the FTD performs intensive inspection. It is used to bypass or block traffic that does not require further inspection by access control policy.
A pre-filter policy contains rules that match L3 and L4 informations, like IP’s and ports. There is no deep packet inspection in a pre-filter policy. We can compare the Prefilter rules to ACL on ASA.
One of the reasons to use this is to quickly allow or deny traffic, without further inspection. For example, you don’t allow FTP traffic. You could create a pre-filter policy that blocks TCP port 21. This means the traffic is not passed to the SNORT engine or check a malware policy. It blocks the traffic without impacting resources on FTD.
We want also to allow SSH traffic for administrator without further inspection. This traffic can be put on the Fast-Path. The fast-path allows traffic while bypassing deeper inspection. You could add this to the pre-filter policy with an action of fast-path, to save resources.
Prefilter Policy is not supported on ASA with FirePOWER Services,instead we use ACL with DENY Action
Demystify and Simplify 