|
|
This chapter describes the Cisco IOS Firewall Intrusion Detection System (IDS) feature. Intrusion detection systems provide a level of protection beyond the firewall by protecting the network from internal and external attacks and threats. Cisco IOS Firewall IDS technology enhances perimeter firewall protection by taking appropriate action on packets and flows that violate the security policy or represent malicious network activity.
For a complete description of the Cisco IOS Firewall IDS commands in this chapter, refer to the "Cisco Secure Integrated Software IDS Commands" chapter of the Cisco IOS Security Command Reference. To locate documentation of other commands that appear in this chapter, use the command reference master index or search online.
This chapter has the following sections:
The Cisco IOS Firewall IDS supports intrusion detection technology for midrange and high-end router platforms with firewall support. It is ideal for any network perimeter, and especially for locations in which a router is being deployed and additional security between network segments is required. It also can protect intranet and extranet connections where additional security is mandated, and branch-office sites connecting to the corporate office or Internet.
The Cisco IOS Firewall IDS feature identifies 59 of the most common attacks using "signatures" to detect patterns of misuse in network traffic. The intrusion-detection signatures included in the Cisco IOS Firewall were chosen from a broad cross-section of intrusion-detection signatures. The signatures represent severe breaches of security and the most common network attacks and information-gathering scans. For a description of Cisco IOS Firewall IDS signatures, refer to the
"Cisco IOS Firewall IDS Signature List" section.
The Cisco IOS Firewall IDS acts as an in-line intrusion detection sensor, watching packets and sessions as they flow through the router, scanning each to match any of the IDS signatures. When it detects suspicious activity, it responds before network security can be compromised and logs the event through Cisco IOS syslog or the Cisco Secure Intrusion Detection System (Cisco Secure IDS, formerly known as Net Ranger) Post Office Protoco The network administrator can configure the IDS system to choose the appropriate response to various threats. When packets in a session match a signature, the IDS system can be configured to take these actions:
Cisco developed its Cisco IOS software-based intrusion-detection capabilities in Cisco IOS Firewall with flexibility in mind, so that individual signatures could be disabled in case of false positives. Also, while it is preferable to enable both the firewall and intrusion detection features of the CBAC security engine to support a network security policy, each of these features may be enabled independently and on different router interfaces. Cisco IOS software-based intrusion detection is part of the Cisco IOS Firewall.
This section has the following sections:
Cisco IOS Firewall is compatible with the Cisco Secure Intrusion Detection System (formally known as NetRanger). The Cisco Secure IDS is an enterprise-scale, real-time, intrusion detection system designed to detect, report, and terminate unauthorized activity throughout a network.
The Cisco Secure IDS consists of three components:
Cisco Secure IDS Sensors, which are high-speed network appliances, analyze the content and context of individual packets to determine if traffic is authorized. If a network's data stream exhibits unauthorized or suspicious activity, such as a SATAN attack, a ping sweep, or the transmission of a secret research project code word, Cisco Secure IDS Sensors can detect the policy violation in real time, forward alarms to a Cisco Secure IDS Director management console, and remove the offender from the network.
The Cisco Secure IDS Director is a high-performance, software-based management system that centrally monitors the activity of multiple Cisco Secure IDS Sensors located on local or remote network segments.
The Cisco Secure IDS Post Office is the communication backbone that allows Cisco Secure IDS services and hosts to communicate with each other. All communication is supported by a proprietary, connection-based protocol that can switch between alternate routes to maintain point-to-point connections.
Cisco Secure IDS customers can deploy the Cisco IOS Firewall IDS signatures to complement their existing IDS systems. This allows an IDS to be deployed to areas that may not be capable of supporting a Cisco Secure IDS Sensor. Cisco IOS Firewall IDS signatures can be deployed alongside or independently of other Cisco IOS Firewall features.
The Cisco IOS Firewall IDS can be added to the Cisco Secure IDS Director screen as an icon to provide a consistent view of all intrusion detection sensors throughout a network. The Cisco IOS Firewall intrusion detection capabilities have an enhanced reporting mechanism that permits logging to the Cisco Secure IDS Director console in addition to Cisco IOS syslog.
For additional information about Cisco Secure IDS (NetRanger), refer to the NetRanger User Guide.
The Cisco IOS Firewall IDS acts as an in-line intrusion detection sensor, watching packets as they traverse the router's interfaces and acting upon them in a definable fashion. When a packet, or a number of packets in a session, match a signature, the Cisco IOS Firewall IDS may perform the following configurable actions:
The following describes the packet auditing process with Cisco IOS Firewall IDS:
 |
Note It is recommended that you use the drop and reset actions together. |
|
Note This process is different than on the Cisco Secure IDS Sensor appliance, which identifies all signature matches for each packet. |
Cisco IOS Firewall IDS capabilities are ideal for providing additional visibility at intranet, extranet, and branch-office Internet perimeters. Network administrators enjoy more robust protection against attacks on the network and can automatically respond to threats from internal or external hosts.
The Cisco IOS Firewall with intrusion detection is intended to satisfy the security goals of all of our customers, and is particularly appropriate for the following scenarios:
The performance impact of intrusion detection will depend on the configuration of the signatures, the level of traffic on the router, the router platform, and other individual features enabled on the router such as encryption, source route bridging, and so on. Enabling or disabling individual signatures will not alter performance significantly, however, signatures that are configured to use Access Control Lists will have a significant performance impact.
Because this router is being used as a security device, no packet will be allowed to bypass the security mechanisms. The IDS process in the Cisco IOS Firewall router sits directly in the packet path and thus will search each packet for signature matches. In some cases, the entire packet will need to be searched, and state information and even application state and awareness must be maintained by the router.
For auditing atomic signatures, there is no traffic-dependent memory requirement. For auditing compound signatures, CBAC allocates memory to maintain the state of each session for each connection. Memory is also allocated for the configuration database and for internal caching.
The following is a complete list of Cisco IOS Firewall IDS signatures. A signature detects patterns of misuse in network traffic. In Cisco IOS Firewall IDS, signatures are categorized into four types:
An info signature detects information-gathering activity, such as a port sweep.
An attack signature detects attacks attempted into the protected network, such as denial-of-service attempts or the execution of illegal commands during an FTP session.
Info and attack signatures can be either atomic or compound signatures. Atomic signatures can detect patterns as simple as an attempt to access a specific port on a specific host. Compound signatures can detect complex patterns, such as a sequence of operations distributed across multiple hosts over an arbitrary period of time.
The intrusion-detection signatures included in the Cisco IOS Firewall were chosen from a broad cross-section of intrusion-detection signatures as representative of the most common network attacks and information-gathering scans that are not commonly found in an operational network.
The following signatures are listed in numerical order by their signature number in the Cisco Secure IDS Network Security Database. After each signature's name is an indication of the type of signature (info or attack, atomic, or compound).
|
Note Atomic signatures marked with an asterisk (Atomic*) are allocated memory for session states by CBAC. |
1000 IP options-Bad Option List (Info, Atomic)
1001 IP options-Record Packet Route (Info, Atomic)
1002 IP options-Timestamp (Info, Atomic)
1003 IP options-Provide s,c,h,tcc (Info, Atomic)
1004 IP options-Loose Source Route (Info, Atomic)
1005 IP options-SATNET ID (Info, Atomic)
1006 IP options-Strict Source Route (Info, Atomic)
1100 IP Fragment Attack (Attack, Atomic)
1101 Unknown IP Protocol (Attack, Atomic)
1102 Impossible IP Packet (Attack, Atomic)
2000 ICMP Echo Reply (Info, Atomic)
2001 ICMP Host Unreachable (Info, Atomic)
2002 ICMP Source Quench (Info, Atomic)
2003 ICMP Redirect (Info, Atomic)
2004 ICMP Echo Request (Info, Atomic)
2005 ICMP Time Exceeded for a Datagram (Info, Atomic)
2006 ICMP Parameter Problem on Datagram (Info, Atomic)
2007 ICMP Timestamp Request (Info, Atomic)
2008 ICMP Timestamp Reply (Info, Atomic)
2009 ICMP Information Request (Info, Atomic)
2010 ICMP Information Reply (Info, Atomic)
2011 ICMP Address Mask Request (Info, Atomic)
2012 ICMP Address Mask Reply (Info, Atomic)
2150 Fragmented ICMP Traffic (Attack, Atomic)
2151 Large ICMP Traffic (Attack, Atomic)
2154 Ping of Death Attack (Attack, Atomic)
( IP offset * 8 ) + (IP data length) > 65535
3040 TCP - no bits set in flags (Attack, Atomic)
3041 TCP - SYN and FIN bits set (Attack, Atomic)
3042 TCP - FIN bit with no ACK bit in flags (Attack, Atomic)
3050 Half-open SYN Attack/SYN Flood (Attack, Compound)
3100 Smail Attack (Attack, Compound)
3101 Sendmail Invalid Recipient (Attack, Compound)
3102 Sendmail Invalid Sender (Attack, Compound)
3103 Sendmail Reconnaissance (Attack, Compound)
3104 Archaic Sendmail Attacks (Attack, Compound)
3105 Sendmail Decode Alias (Attack, Compound)
3106 Mail Spam (Attack, Compound)
3107 Majordomo Execute Attack (Attack, Compound)
3150 FTP Remote Command Execution (Attack, Compound)
3151 FTP SYST Command Attempt (Info, Compound)
3152 FTP CWD ~root (Attack, Compound)
3153 FTP Improper Address Specified (Attack, Atomic*)
3154 FTP Improper Port Specified (Attack, Atomic*)
4050 UDP Bomb (Attack, Atomic)
4100 Tftp Passwd File (Attack, Compound)
6100 RPC Port Registration (Info, Atomic*)
6101 RPC Port Unregistration (Info, Atomic*)
6102 RPC Dump (Info, Atomic*)
6103 Proxied RPC Request (Attack, Atomic*)
6150 ypserv Portmap Request (Info, Atomic*)
6151 ypbind Portmap Request (Info, Atomic*)
6152 yppasswdd Portmap Request (Info, Atomic*)
6153 ypupdated Portmap Request (Info, Atomic*)
6154 ypxfrd Portmap Request (Info, Atomic*)
6155 mountd Portmap Request (Info, Atomic*)
6175 rexd Portmap Request (Info, Atomic*)
6180 rexd Attempt (Info, Atomic*)
6190 statd Buffer Overflow (Attack, Atomic*)
8000 FTP Retrieve Password File (Attack, Atomic*)
See the following sections for configuration tasks for the Cisco IOS Firewall Intrusion Detection System feature. Each task in the list indicates if it is optional or required:
For examples using the commands in this chapter, see the "Cisco IOS Firewall IDS Configuration Examples" section at the end of this chapter.
To initialize Cisco IOS Firewall IDS on a router, use the following commands in global configuration mode:
| Command | Purpose | |
|---|---|---|
Step 1 | router(conf)#ip audit smtp spam recipients | Use the ip audit smtp command to set the threshold beyond which spamming in e-mail messages is suspected. Here, recipients is the maximum number of recipients in an e-mail message. The default is 250. |
Step 2 | router(conf)#ip audit po max-events number_events | Use the ip audit po max-events command to set the threshold beyond which cued events are dropped from the cue for sending to the Cisco Secure IDS Director. Here, number_events is the number of events in the event cue. The default is 100. Increasing this number may have an impact on memory and performance, as each event in the event cue requires 32 KB of memory. |
Step 3 | router(conf)#exit | Leaves global configuration mode. |
|
Note You must reload the router every time you make a Post Office configuration change. |
To initialize the Post Office system, use the following commands in global configuration mode:
| Command | Purpose | |||
|---|---|---|---|---|
Step 1 | router(conf)# ip audit notify nr-director or router(conf)#ip audit notify log | Use the ip audit notify command to send event notifications (alarms) to either a Cisco Secure IDS Director or a syslog server, or both. For example, if you are sending alarms to a Cisco Secure IDS Director, use the nr-director keyword in the command syntax. If you are sending alarms to a syslog server, use the log keyword in the command syntax. | ||
Step 2 | router(conf)# ip audit po local hostid host-id orgid org-id | If you are sending alarms to a Cisco Secure IDS Director, you must set the Post Office parameters for both the router (using the ip audit po local command) and the Cisco Secure IDS Director (using the ip audit po remote command). Here, host-id is a unique number between 1 and 65535 that identifies the router, and org-id is a unique number between 1 and 65535 that identifies the organization to which the router and Director both belong. | ||
Step 3 | router(conf)# ip audit po remote hostid host-id orgid org-id rmtaddress ip-address localaddress ip-address port port-number preference preference-number timeout seconds application application-type | If you are sending alarms to a Cisco Secure IDS Director, you must also set the Post Office parameters for both the Cisco Secure IDS Director (using the ip audit po remote command).
| ||
Step 4 | router(conf)# logging console info | If you are sending alarms to the syslog console, you have the option of seeing the syslog messages on the router console. | ||
Step 5 | router# exit | Leaves global configuration mode. | ||
Step 6 | router# write memory | Saves the configuration. | ||
Step 7 | router# reload | Reloads the router. |
After you have configured the router, add the Cisco IOS Firewall IDS router's Post Office information to the /usr/nr/etc/hosts and /usr/nr/etc/routes files on the Cisco Secure IDS Sensors and Directors communicating with the router. You can do this with the nrConfigure tool in Cisco Secure IDS. For more information, refer to the NetRanger User Guide.
To configure and apply audit rules, use the following commands starting in global configuration mode:
| Command | Purpose | |||||
|---|---|---|---|---|---|---|
Step 1 | router(conf)# ip audit info {action [alarm]
[drop] [reset]}
router(conf)#ip audit attack {action [alarm]
[drop] [reset]}
| Use the ip audit info action and ip audit attack action commands to set the default actions for info and attack signatures. Both types of signatures can take any or all of the following actions: alarm, drop, and reset. The default action is alarm. | ||||
Step 2 | router(conf)# ip audit name audit-name {info |
attack} [list standard-acl] [action [alarm]
[drop] [reset]]
| Use the ip audit name command to create audit rules, where audit-name is a user-defined name for an audit rule. For example: ip audit name audit-name info ip audit name audit-name attack The default action is alarm.
You can also use the ip audit name command to attach access control lists to an audit rule for filtering out sources of false alarms. In this case standard-acl is an integer representing an ACL. If you attach an ACL to an audit rule, the ACL must be defined as well: ip audit name audit-name {info|attack} list acl-list
In the following example, ACL 99 is attached to the audit rule INFO, and ACL 99 is defined: ip audit name INFO info list 99 access-list 99 deny 10.1.1.0 0.0.0.255 access-list 99 permit any
| ||||
Step 3 | router(conf)# ip audit signature signature-id
{disable | list acl-list}
| Use the ip audit signature command to disable individual signatures. Disabled signatures are not included in audit rules, as this is a global configuration change: ip audit signature signature-number disable To re-enable a disabled signature, use the no ip audit signature command, where signature-number is the number of the disabled signature. You can also use the ip audit signature command to apply ACLs to individual signatures for filtering out sources of false alarms. In this case signature-number is the number of a signature, and acl-list is an integer representing an ACL: ip audit signature signature-number list acl-list For example, ACL 35 is attached to the 1234 signature, and then defined: ip audit signature 1234 list 35 access-list 35 deny 10.1.1.0 0.0.0.255 access-list 35 permit any
| ||||
Step 4 | router(conf)# interface interface-number | Enters interface configuration mode. | ||||
Step 5 | router(conf)# ip audit audit-name | Use the ip audit command to apply an audit rule at an interface. With this command, audit-name is the name of an existing audit rule, and direction is either in or out. | ||||
Step 6 | router(conf)# exit | Leaves interface configuration mode. | ||||
Step 7 | router(conf)# ip audit po protected ip-addr [to ip-addr] | After you apply the audit rules to the router interfaces, use the ip audit po protected command to configure which network should be protected by the router. Here, ip_addr is the IP address to protect. | ||||
Step 8 | router(conf)# exit | Leaves global configuration mode. |
You can verify that Cisco IOS Firewall IDS is properly configured with the show ip audit configuration command (see Example 1).
ids2611# show ip audit configuration
Event notification through syslog is enabled
Event notification through Net Director is enabled
Default action(s) for info signatures is alarm
Default action(s) for attack signatures is alarm drop reset
Default threshold of recipients for spam signature is 25
PostOffice:HostID:55 OrgID:123 Msg dropped:0
:Curr Event Buf Size:100 Configured:100
HID:14 OID:123 S:1 A:2 H:82 HA:49 DA:0 R:0 Q:0
ID:1 Dest:10.1.1.99:45000 Loc:172.16.58.99:45000 T:5 S:ESTAB *
Audit Rule Configuration
Audit name AUDIT.1
info actions alarm
attack actions alarm drop reset
You can verify which interfaces have audit rules applied to them with the show ip audit interface command (see Example 2).
ids2611# show ip audit interface Interface Configuration Interface Ethernet0 Inbound IDS audit rule is AUDIT.1 info actions alarm attack actions alarm drop reset Outgoing IDS audit rule is not set Interface Ethernet1 Inbound IDS audit rule is AUDIT.1 info actions alarm attack actions alarm drop reset Outgoing IDS audit rule is not set
This section describes the EXEC commands used to monitor and maintain Cisco Secure Integrated Software IDS.
| Command | Purpose |
|---|---|
router# clear ip audit configuration | Disables Cisco IOS Firewall IDS, removes all intrusion detection configuration entries, and releases dynamic resources. |
router# clear ip audit statistics | Resets statistics on packets analyzed and alarms sent. |
router# show ip audit statistics | Displays the number of packets audited and the number of alarms sent, among other information. |
The following display provides sample output from the show ip audit statistics command:
Signature audit statistics [process switch:fast switch] signature 2000 packets audited: [0:2] signature 2001 packets audited: [9:9] signature 2004 packets audited: [0:2] signature 3151 packets audited: [0:12] Interfaces configured for audit 2 Session creations since subsystem startup or last reset 11 Current session counts (estab/half-open/terminating) [0:0:0] Maxever session counts (estab/half-open/terminating) [2:1:0] Last session created 19:18:27 Last statistic reset never HID:1000 OID:100 S:218 A:3 H:14085 HA:7114 DA:0 R:0
The following sections provide Cisco IOS Firewall IDS configuration examples:
In the following example, Cisco IOS Firewall IDS is initialized. Notice that the router is reporting to two Directors. Also notice that the AUDIT.1 audit rule will apply both info and attack signatures.
ip audit smtp spam 25 ip audit notify nr-director ip audit notify log ip audit po local hostid 55 orgid 123 ip audit po remote hostid 14 orgid 123 rmtaddress 10.1.1.99 localaddress 10.1.1.1 ip audit po remote hostid 15 orgid 123 rmtaddress 10.1.2.99 localaddress 10.1.1.1 ip audit name AUDIT.1 info action alarm ip audit name AUDIT.1 attack action alarm drop reset interface e0 ip address 10.1.1.1 255.0.0.0 ip audit AUDIT.1 in interface e1 ip address 172.16.57.1 255.255.255.0 ip audit AUDIT.1 in
In the following example, an ACL is added to account for a Cisco Secure IDS Scanner (172.16.59.16) that scans for all types of attacks. As a result, no packets originating from the device will be audited.
ip audit smtp spam 25 ip audit notify nr-director ip audit notify log ip audit po local hostid 55 orgid 123 ip audit po remote hostid 14 orgid 123 rmtaddress 10.1.1.99 localaddress 10.1.1.1 ip audit po remote hostid 15 orgid 123 rmtaddress 10.1.2.99 localaddress 10.1.1.1 ip audit name AUDIT.1 info list 90 action alarm ip audit name AUDIT.1 attack list 90 action alarm drop reset interface e0 ip address 10.1.1.1 255.0.0.0 ip audit AUDIT.1 in interface e1 ip address 172.16.57.1 255.255.255.0 ip audit AUDIT.1 in access-list 90 deny 172.16.59.16 access-list 90 permit any
The security administrator notices that the router is generating a lot of false positives for signatures 1234, 2345, and 3456. The system administrator knows that there is an application on the network that is causing signature 1234 to fire, and it is not an application that should cause security concerns. This signature can be disabled, as illustrated in the following example:
ip audit smtp spam 25 ip audit notify nr-director ip audit notify log ip audit po local hostid 55 orgid 123 ip audit po remote hostid 14 orgid 123 rmtaddress 10.1.1.99 localaddress 10.1.1.1 ip audit po remote hostid 15 orgid 123 rmtaddress 10.1.2.99 localaddress 10.1.1.1 ip audit signature 1234 disable ip audit name AUDIT.1 info list 90 action alarm ip audit name AUDIT.1 attack list 90 action alarm drop reset interface e0 ip address 10.1.1.1 255.0.0.0 ip audit AUDIT.1 in interface e1 ip address 172.16.57.1 255.255.255.0 ip audit AUDIT.1 in access-list 90 deny 172.16.59.16 access-list 90 permit any
After further investigation, the security administrator discovers that the false positives for signatures 2345 and 3456 are caused by specific applications on hosts 10.4.1.1 and 10.4.1.2, as well as by some workstations using DHCP on the 172.16.58.0 subnetwork. Attaching an ACL that denies processing of these hosts stops the creation of false positive alarms, as illustrated in the following example:
ip audit smtp spam 25 ip audit notify nr-director ip audit notify log ip audit po local hostid 55 orgid 123 ip audit po remote hostid 14 orgid 123 rmtaddress 10.1.1.99 localaddress 10.1.1.1 ip audit po remote hostid 15 orgid 123 rmtaddress 10.1.2.99 localaddress 10.1.1.1 ip audit signature 1234 disable ip audit signature 2345 list 91 ip audit signature 3456 list 91 ip audit name AUDIT.1 info list 90 action alarm ip audit name AUDIT.1 attack list 90 action alarm drop reset interface e0 ip address 10.1.1.1 255.0.0.0 ip audit AUDIT.1 in interface e1 ip address 172.16.57.1 255.255.255.0 ip audit AUDIT.1 in access-list 90 deny 172.16.59.16 access-list 90 permit any access-list 91 deny host 10.4.1.1 access-list 91 deny host 10.4.1.2 access-list 91 deny 172.16.58.0 0.0.0.255 access-list 91 permit any
The company has now reorganized and has placed only trusted people on the 172.16.57.0 network. The work done by the employees on these networks must not be disrupted by Cisco IOS Firewall IDS, so attack signatures in the AUDIT.1 audit rule now will only alarm on a match.
For sessions that originate from the outside network, any attack signature matches (other than the false positive ones that are being filtered out) are to be dealt with in the following manner: send an alarm, drop the packet, and reset the TCP session.
This dual-tier method of signature response is accomplished by configuring two different audit specifications and applying each to a different ethernet interface, as illustrated in the following example:
ip audit smtp spam 25 ip audit notify nr-director ip audit notify log ip audit po local hostid 55 orgid 123 ip audit po remote hostid 14 orgid 123 rmtaddress 10.1.1.99 localaddress 10.1.1.1 ip audit po remote hostid 15 orgid 123 rmtaddress 10.1.2.99 localaddress 10.1.1.1 ip audit signature 1234 disable ip audit signature 2345 list 91 ip audit signature 3456 list 91 ip audit name AUDIT.1 info list 90 action alarm ip audit name AUDIT.1 attack list 90 action alarm ip audit name AUDIT.2 info action alarm ip audit name AUDIT.2 attack alarm drop reset interface e0ip address 10.1.1.1 255.0.0.0 ip audit AUDIT.2 in
interface e1ip address 172.16.57.1 255.255.255.0 ip audit AUDIT.1 in
access-list 90 deny host 172.16.59.16 access-list 90 permit any access-list 91 deny host 10.4.1.1 access-list 91 deny host 10.4.1.2 access-list 91 deny 172.16.58.0 0.0.0.255 access-list 91 permit any
Posted: Thu Aug 10 08:51:51 PDT 2000
Copyright 1989-2000©Cisco Systems Inc.