[Link].

sa
Advanced Technologies in
Networks Security

Prepared By: NOUF HAMAD

Cisco FirePOWER Next-Generation IPS
(NGIPS)
This lesson covers the following topics:
• Configurations
• Implementing an Access Control Policy
• Describe preprocessors
• Traffic Flow through Preprocessors
• Cisco FireSIGHT File-type detection architecture.
• Implement correlation policies
• Describe SNORT rules
• Implement SSL decryption policies
What is a Next-Generation IPS (NGIPS)?
What is a NGIPS ?
FirePower Next-Generation IPS

Cisco FirePOWER Next-Generation IPS (NGIPS) is a powerful security solution that provides
visibility and control over applications, users, and network. It combines advanced threat
protection, access control, and network segmentation with real-time analytics and
automated response [Link] current permissions.
 Cisco fireSIGT system detection and architecture

Cisco firepower next generation firewall Appliance include the following licenses:

• Protection: IPS capability, built on sort technology.

• fireSIGT: network intelligence to provide more accurate
alerting and automation.
• Control: Access control features based on application
awareness, user intelligence, layer 2 and layer 3 filtering and
subscription based URL filtering capability.
Cisco fireSIGT system detection and architecture
 Cisco FireSIGT system overview

The IPS Monitors your environment for suspicious or malicious activity

discovery:

• User discovery: see the users on your monitored networks.

• Network discovery :see hosts, services and client applications that are
running on your networks
• connection discovery :see network traffic to understand how your network
resources are being utilized.
Configurations
 Registration configuration on
the management center
I must have access to Firepower Mangment center

Management center >device > add device.

Registration configuration on
the management center
 Registration configuration on
the management center

• Interface tab

This is a firepower for a device.

 Aggregate interface

You create aggregate link by creating a switch or routed LAG. When you create an
aggregation group, A logical interface called an aggregate interface is [Link] an upper
layer entity a LAG looks like a single logical link and data traffic is transmitted through the
aggregate interface.
Adding aggregate interface
Implementing an Access Control Policy
Access control policy Overview

The access control Policy brings together all the detection futures
of the Cisco FireSIGHT system into a single policy that allows you
to control which network traffic to allow or disallow. everything
from intrusion prevention to URL filtering can be included in the
policy, and you have total control over which areas of your
network to protect with the access control policy.
 Access control policy Overview

Policies > access control

Access control policy Overview

you can create a new policy

Access control policy Overview

- The appropriate policy action must be determined

- Any policy in which there is a default action
- And any rule that has its own action inside it
 Security Intelligence

Within him are all the sources and the destination

 HTTP Responses

determine HTTP is it Block or Allow

Add rule
Describe preprocessors
 Describe preprocessors

Processors are modules of the IPS engine that handle traffic before sending
it to the IPS [Link] play an important role with regard to how the IPS
engine evaluates network traffic by providing services that are needed by
the IPS rule set.

the target :
You can configure preprocessors to ensure that the packets that are
processed by managed device resemble,as closely as possible , the packets
that are processed by the hosts that you wish to protect on your network.
Traffic Flow through Preprocessors
 Traffic Flow through Preprocessors

PreProcessors are configured in network analysis policies.

It is a feature within Firepower that allows me to analyze the traffic inside Firepower
 Network Analysis policy configuration

We can create a policy

Anything related to network policy is linked to the policy of its name Balanced security and connectivity
Cisco FireSIGHT File-type detection architecture.
 Cisco FireSIGHT File-type detection architecture

Inside the firepower, I can set a policy for files, and this policy specifies the type of file that is allowed to
enter my network and the file that is forbidden to enter my network

If the file type is of the type prohibited in my policy:

- file is scanned, then any file malure is removed from it, and then it is sent to me
Or
- I create a policy that permanently blocks access to this file
Implement correlation policies
 Correlation policies overview

• correlation policies allow the Defense center to respond to threats on the

network in real time
• correlation policies describe the type of activity that constitutes a policy
violation.
• when a policy violation occurs, the Defense Center logs a correlation events to
the database.
• With correlation policies, the Defense center may be configured to trigger
responses automatically when a violation is detected.

responses include:
• Remediation:Blocking a host at the firewall or router
• Alert:Email,SNMP,and syslog
• A combination of remediations and alerts.
 remediation configuration

Policies > actions >Remediation modules

show a list of the available modules and allows you to import new modules
Creating correlation policy rules
Whitelist overview
Describe SNORT rules
 SNORT rule headers

The rule header is the Portion of the rule that identifies how to match traffic , based on the following Criteria:
• Action
• protocol
• source IP
• source port.
• operator
• Destination IP
• Destination Port
Every rule header must specify these Parameters.
 SNORT rule headers

• SNORT is considered the most famous tool that detects vulnerabilities and works on
a Linux system.

• SNORT is considered open source. Anything I do for Fire Power is done through GUI .
He translates it into rules for an application called SNORT.

• We only give SNORT my network subnet mask, and SNORT performs a scan on the
network and looks for devices and vulnerabilities, how to exploit them.
 Content matches

• Content keyword
- Use the content keyword to specify content to be detected in a packet.
- Match content:
-ASCII text: bin/sh
-Hexadecimal: (binary byte code):|90C8 C0FF FFFF|
-A combination of ASCII and hexadecimal:|90C8 C0FF FFFF| /bin/sh
Implement SSL decryption policies
 Cisco FireSIGT SSL inspection

•How does FirePower deal with the SSL, which is considered traffic encrypted from the SSL protocol
•In any traffic, inside or outside, And he was dealing with SSL it is considered encrypted traffic
•The FirePower can decrypt SSL in one of two ways.
-Decrypt-Resign
-Decrypt-Known key
Decrypt-Resign
 Decrypt-Resign
1- The client initiates the connection .
2- The managed device sees the connection and checks its SSL rules to see if one matches. If there is a match,
the managed device. initiates a connection to the external server on Behalf of the client

3- the external server responds to the connection with the normal server response which contains the External server
Certificate and public key.
- The managed device validates the external server certificate using one of the public root CA certificates that are
listed in its trusted CA object.
- The managed device decrypts the traffic from the external server, Using the external server public key

4-The managed device responds to the client, but instead of sending the external server certificate to the client ( for
the client to authenticate the external server) the managed device can either re-sign the external server Certificate
which will generate a whole new certificate or just replace the public key in the External server certificate.

5-the session continues with the managed device acting as an intermediary between the client and the server.
Decrypt-Known key
 Decrypt-Known key

1-A client from an external source initiates an SSL connection to a server that you are protecting with the managed
device.

2-The managed device allows the connection to proceed if it matches a rule in the ESL policy. when the SSL handshake
completes and the session becomes encrypted, The managed device is able to decrypt the connection because you
have installed the server certificate and private key on it.

- Therefore, traffic enters the managed device in an encrypted state and gets decrypted using the server keys.
- The decrypted traffic is sent to the managed device detection processes
- Traffic that doesn't violate a detection process Policy is re-encrypted and sent to its destination.
 Decrypt-Known key

policies > Access Control > SSL

 Decrypt-Known key

policies > Access Control > SSL> Trusted CA

To make sure the certificate is valid
Resource

BOOK : Implementing Cisco ThreatControlSolutions(SITCS)