FTD · BUILD

FTD-style: a prefilter ahead of the access rules

A prefilter runs first, by addresses and ports alone. Use it for traffic you can decide without reading it. Requests to SRV go through an IPS policy, which is what you want for strangers. But the backup system at 100.64.10.10 (LAP1) sends data that looks like an attack and must not be inspected, and 100.65.0.0/16 is a network you never want to hear from.

Cisco FTD-style track · Cisco FTD-style, FTD Manager, Cisco router · 5 objectives

Open in simulator More Cisco FTD-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

Host object BACKUP (100.64.10.10), and network object BADNET (100.65.0.0/16).
Prefilter policy EDGE-PF with three rules in this order: BAD-NET, block from any to any from BADNET; BACKUP-WEB, fastpath tcp port 80 from BACKUP to WEB; and REST, analyze everything else.
Make ACP1 use EDGE-PF, and deploy.
From LAP1: traffic tcp 203.0.113.10 80 payload "GET /../../etc/passwd" now arrives, because fastpath skips Snort. show access-list on FTD1 shows the prefilter rules first.
Remove BACKUP-WEB and deploy. The same packet is dropped by Snort, because Analyze hands it on to the access rules.

Start this lab

Before you start

Fastpath is the trust keyword in the firewall’s lines. It is fast and blind: nothing behind it inspects the traffic, so keep it narrow. A prefilter sees interface and address and port, never applications or URLs.

Concept

A prefilter decides first, by address and port alone

A prefilter runs ahead of the access control policy, for traffic you can decide without reading it. Fastpath skips the access rules and Snort. Block drops at once. Analyze hands traffic on to the access control policy, past any prefilter rules left. Fastpath is fast and blind: nothing behind it inspects the traffic.

Concept

An access rule reads the address, Snort reads the contents

An access rule allows or blocks by address and port, so it passes an attack on an allowed port. An Allow rule with an IPS policy sends its traffic through Snort, which reads the contents and compares them with its rules. Prevention mode drops what a drop rule matches, and detection mode only reports it, so you can see what a policy would break before you trust it.