FTD · SNORT

FTD-style: filter by application and URL

Staff on PC1 can reach any web server, because WEB-OUT allows all TCP from INSIDE to OUTSIDE. A port number can’t say what a site or an application is: social networks and ordinary sites all use port 80, and file sharing uses any port. Rules that name an application or a URL read the packet to find out. On PC1, the command traffic sends one packet with the text you give it.

Cisco FTD-style track · Cisco FTD-style, FTD Manager, Cisco router · 4 objectives

Open in simulator More Cisco FTD-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

On PC1, send a request to a social network and one to an ordinary site. Both arrive: traffic tcp 198.51.100.1 80 payload "GET / Host: facebook.com", then traffic tcp 198.51.100.1 80 payload "GET / Host: www.example.org".
In ACP1, above WEB-OUT, add rule NO-SOCIAL: block tcp from INSIDE to OUTSIDE with URL category social, and Log on.
Above WEB-OUT, add rule NO-P2P: block tcp from INSIDE to OUTSIDE with application bittorrent. Add URL object FILES (files.example.net/downloads) and a rule NO-FILES blocking it.
Deploy. From PC1: facebook.com and traffic tcp 198.51.100.1 6881 payload "BitTorrent protocol" are blocked, so is traffic tcp 198.51.100.1 80 payload "GET /downloads/a.zip Host: files.example.net", and www.example.org still arrives.

Start this lab

Before you start

Rules are read in order, so these must go above WEB-OUT: use Place before rule, or before WEB-OUT in the console. A rule that names an application or a URL only matches when it can read them, so it does nothing for a ping. show applications and show url-categories list what this model knows: short teaching lists, not a vendor’s database.

Concept

A port can’t say what a site or an application is

Social networks and ordinary sites all use port 80, and file sharing uses any port. A rule can name an application or a URL instead, and the firewall reads the traffic to find out. Order still matters: such a rule goes above the rule that allows the port, and it does nothing for traffic it can’t read, such as a ping.