FTD · SNORT

FTD-style: stop an attack with an IPS policy

SRV is published on port 80, and the access rule allows port 80 from anywhere. An access rule looks at addresses and ports, so it cannot tell a normal request from an attack on the same port. Snort reads what is inside. On LAP1, the command traffic sends one TCP packet with the text you give it, along the real path.

Cisco FTD-style track · Cisco FTD-style, FTD Manager, Cisco router · 4 objectives

Open in simulator More Cisco FTD-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

On LAP1, send a normal request and an attack. Both arrive: traffic tcp 203.0.113.10 80 payload "GET /index.html", then traffic tcp 203.0.113.10 80 payload "GET /../../etc/passwd".
On the Intrusion screen, create IPS policy BRANCH-IPS: base connectivity, mode prevention. On Access control, attach it to rule HTTP-WEB.
Deploy. On LAP1, the attack is now dropped, and the ping-style reason names the Snort rule. The normal request still arrives.
Analysis shows the drop under Intrusion events, and FTD1’s show snort statistics counts it.

Start this lab

Before you start

An IPS policy only runs on Allow rules: Block drops first, and Trust skips Snort on purpose. Snort rules are not in show running-config, because they go to Snort, not to the firewall configuration. Look for them in the deployment preview.

Concept

An access rule reads the address, Snort reads the contents

An access rule allows or blocks by address and port, so it passes an attack on an allowed port. An Allow rule with an IPS policy sends its traffic through Snort, which reads the contents and compares them with its rules. Prevention mode drops what a drop rule matches, and detection mode only reports it, so you can see what a policy would break before you trust it.

Concept

Nothing changes until you deploy

A manager holds intent. Editing it changes nothing on any firewall, and a device shows Pending when the two differ. Deploy compiles the policy to configuration lines and replaces the firewall’s configuration as one change. If a line fails, the firewall goes back to what it had.