FTD · SNORT

FTD-style: the IPS can’t see inside HTTPS until you decrypt

SRV now also serves HTTPS, and rule HTTPS-WEB already carries the IPS policy BRANCH-IPS. Yet the same attack that is dropped over port 80 gets through on 443: TLS hides the request, and Snort cannot read what it cannot see. SRV is your own server, so the firewall can hold its key and decrypt.

Cisco FTD-style track · Cisco FTD-style, FTD Manager, Cisco router · 3 objectives

Open in simulator More Cisco FTD-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

On LAP1, send a normal request and the attack over HTTPS. Both arrive, although the IPS is on: traffic tcp 203.0.113.10 443 payload "Host: www.branch.example GET /index.html", then traffic tcp 203.0.113.10 443 payload "Host: www.branch.example GET /../../etc/passwd".
On the Decryption screen, add decryption rule WEB-KEY: Decrypt Known Key, from OUTSIDE to DMZ, destination WEB (your own server).
Deploy. On LAP1, the attack is now dropped by Snort rule 1000101, and the normal request still arrives.

Start this lab

Before you start

Decrypt Known Key is for a server you own: the firewall holds its certificate and key, and nobody sees a warning. Decrypt Re-Sign is for traffic going out to sites you don’t own, and the hosts must trust the firewall’s CA. Without decryption, the firewall still sees the server name (SNI).

Concept

Snort can only read what it can see: decrypt HTTPS first

TLS encrypts everything after the handshake, so an IPS reading HTTPS sees only the ClientHello and the server name (SNI). An attack inside the encrypted request passes every Snort rule. An SSL decryption policy decides which flows the firewall opens up: Decrypt Known Key for your own servers, whose key it holds, and Decrypt Re-Sign for traffic going out, where the hosts must trust the firewall’s CA. Rules match real addresses, before NAT on the way in.

Concept

An access rule reads the address, Snort reads the contents

An access rule allows or blocks by address and port, so it passes an attack on an allowed port. An Allow rule with an IPS policy sends its traffic through Snort, which reads the contents and compares them with its rules. Prevention mode drops what a drop rule matches, and detection mode only reports it, so you can see what a policy would break before you trust it.