Intrusion Prevention. Sophos v16.5

Sophos XG Firewall | Protect | 387

By default, the reflexive rule is not created.

Figure 360: Routing

11. Specify the logging option for the user application traffic.

Log Firewall Traffic

Click to enable logging of permitted and denied traffic.

Figure 361: Log Traffic

Related information

Protect Internal Email Server - Legacy Mode

Intrusion Prevention

This section covers the following topics:

•

DoS Attacks

: Provides information about DoS attacks.

•

IPS Policies

: Allows you to configure IPS policies.

•

Custom IPS Signatures

: Allows you to add custom IPS signatures.

•

DoS & Spoof Protection

: Allows you to configure DoS settings to identify DoS attacks.

DoS Attacks

The page provides information about DoS attacks. The list shows:

Attack Type

Displays the attack type: SYN Flood, UDP Flood, TCP Flood, ICMP Flood and IP Flood.

Source

Displays whether source packet control is applied or not. If applied, it indicates the number of packets dropped.

Destination

Displays whether destination packet control is applied or not. If applied, it indicates the number of packets dropped.

Click the name of the attack type you want to view to get real time updates on flooding.

Sophos XG Firewall | Protect | 388

Figure 362: DoS Attacks

IPS Policies

This page displays the list of all the pre-defined and custom IPS policies.

The device is a real time Intrusion Prevention System (IPS) system that protects your network from known and unknown attacks by worms and viruses, hackers and other Internet risks.

The device at the perimeter of your network analyzes entire traffic and prevents attacks from reaching your network.

Whether it is a worm, a suspicious web request, a hacker targeting your mail server or any other attack - it simply does not get through.

Note: Intrusion Prevention System module is a subscription module that needs to be subscribed before use.

Note: You can also view and manage the IPS status on the Monitor & Analyze > Diagnostics > Services page.

IPS consists of a signature engine with a predefined set of signatures. Signatures are the patterns that are known to be harmful. IPS compares traffic to these signatures and responds at a high rate of speed if it finds a match. Signatures included within the device are not editable.

As per your network requirements, device allows you to define multiple policies instead of one global policy, to decrease packet latency and reduce the false positives.

IPS policy allows you to view predefined signatures and customize the intrusion prevention configuration at the category as well as individual signature level. Categories are signatures grouped together based on the application and protocol vulnerabilities.

The device instead of providing only a single policy (global) for managing multiple networks/hosts, allows to tailor policy per network/host i.e. allows to define multiple policies for managing multiple networks/hosts.

To enable the Intrusion Prevention System, apply IPS policy from Security Policies. You can create rule to apply:

• single policy for all the users/networks

• different policies for different users/networks or hosts

As Security Policies control all traffic passing through the device and decide whether to allow or drop the connection,

IPS rule will be applied to only that traffic/packet which passes through Firewall.

Category

Signatures are organized in categories such as DNS, Finger, P2P, DDOS, and others. These signature categories are listed in the policy. You can configure these categories to change the prevention and/or detection settings. To perform

Intrusion Prevention, you need to enable IPS services for each category i.e. you will be able to configure attack threats for individual signature only if an IPS service for the category is “Enabled”.

Each IPS policy contains a set of signatures that device searches for, logs, blocks and allows to:

• Enable or disable category from IPS protection.

• Enable or disable individual signature in a category to tailor IPS protection based on your network environment.

Sophos XG Firewall | Protect | 389

• Define an action to be taken when the matching traffic pattern is found. Device can either detect or drop the connection. In either of the case, device generates the log and alerts the Network Administrator.

IPS provides six actions for managing attack threats: (action if signature matches)

• Allow Packet - Allows the packet to its intended destination.

• Drop Packet - Drops packets if detects any traffic that matches the signature.

• Disable - Disables the signature, if it detects any traffic that matches the signature.

• Drop Session - Drops the entire session if detects any traffic that matches the signature.

• Reset - Resets entire session if detects any traffic that matches the signature.

• Bypass Session - Allows the entire session if detects any traffic that matches the signature.

In packet-based actions, the device checks each packet before taking an action while for session-based action, only the first packet is checked and an action is taken. In case of Reset, TCP reset packet is sent to the originator. In all the cases, the device generates the log and alerts the Network Administrator.

To save resources and avoid latency, set action as “Bypass Session” as in this, if the initial packets match the signature then the rest of the session packets will not be scanned at all.

To avoid getting high number of Alerts and save resources, set action as “Drop session” as in this, if the device identifies attack in the initial packets then it will terminate the entire session instead of scanning all the session packets.

The page provides option to add a new policy, configure the handling of signatures by category or on a signature-bysignature basis, or delete the policy.

The device provides following pre-defined policies. You can directly use policies 1 to 6 without any modifications while policies 7 to 10 can either be used directly or, can be modified as per your requirements:

1. DMZ TO LAN

2. DMZ TO WAN

3. LAN TO DMZ

4. LAN TO WAN

5. WAN TO DMZ

6. WAN TO LAN

7. generalpolicy

8. lantowan strict policy

9. lantowan general policy

10. dmzpolicy

Create an IPS Policy

This page describes how to quickly configure a new IPS policy.

1. Go to Protect > Intrusion Prevention > IPS Policies and click Add.

2. Specify the following:

Name

Enter a unique name for the IPS policy.

Description

Enter a description for the IPS policy.

Clone Rules

Select the IPS policy to be used as a template from the available list.

Available Options:

• generalpolicy

• lantowan_strict

• lantowan_general

• dmzpolicy

Sophos XG Firewall | Protect | 390

• LAN to WAN

• LAN to DMZ

• WAN to DMZ

• WAN to LAN

• DMZ to WAN

• DMZ to LAN

Figure 363: Details

3. Click Save.

Once the policy is created, policy rules can be added to take appropriate action for signatures in the policy. Define a rule to configure an action to be taken when the matching traffic pattern is found. If the rules are already added, a list of rules is displayed along with its details like signature filtering criteria, action. You can add, update, or delete the rules.

IPS Policy Rules

This page describes how to quickly configure IPS policy rules.

Once the policy is created, policy rules can be added to take appropriate action for signatures in the policy. Define a rule to configure an action to be taken when the matching traffic pattern is found. If the rules are already added, a list of rules is displayed along with its details like signature filtering criteria, action.

1. Go to Protect > Intrusion Prevention > IPS Policies .

2.

Click on the icon under the Manage column for the IPS policy for which you want to add the policy rule.

3. Click Add.

4. Specify the following:

Rule Name

Enter a unique name for the IPS policy rule.

Figure 364: Rule Detail

5. Enter the Sgnature Criteria.

Default

Select to view a list of default signatures.

Custom Signature

Select to view a list of custom signatures.

Category

Select IPS signature category from the list of available categories.

Sophos XG Firewall | Protect | 391

Severity

Severity is the level of threat posed by the attack. Select the type of severity from the available options.

Available Options:

• Select All

• 1 - Critical

• 2 - Major

• 3 - Moderate

• 4 - Minor

• 5 - Warning

Platform

Platform is the OS affected by the attack. Select the platform from the available options:

Available Options:

• Select All

• Windows

• Linux

• Unix

• MAC

• Solaris

• BSD

• Other

Target

Target is the type of device targeted by the attack. Select the target from available options:

Available Options:

• Select All

• Client

• Server

Figure 365: Signature Criteria

6. Manage the list of Matching Signatures.

Select All

Select to choose all the signatures listed for the selected criteria.

Based on the signature criteria the signatures are made available.

Select Individual Signature

Select to customize the choice of signatures list for the selected criteria.

Based on the signature criteria the signatures are made available.

Search

Specify the signature name in the textbox to search a signature.

This option is available, only if the option Select Individual Signature is selected.

Sophos XG Firewall | Protect | 392

Sophos XG Firewall | Protect | 393

Figure 366: List of Matching Signatures

7. Specify the Action details.

Action

Select an action to be taken from the available options:

Available Options:Recommended: This action means that you want the OS to handle this alert level according to best-fit recommendations.Allow Packet: Allows the packet to its intended destination.Drop Packet: Drops packets if it detects any traffic that matches the signature. Disable:

Disables the signature, if it detects any traffic that matches the signature. Drop Session: Drops the entire session if detects any traffic that matches the signature. Reset: Resets entire session if detects any traffic that matches the signature.Bypass Session: Allows the entire session if detects any traffic that matches the signature.

Figure 367: Action

8. Click Save.

Custom IPS Signatures

This page displays the list of all the custom IPS patterns.

Custom IPS Patterns provide the flexibility to customize IPS for diverse network environments. Predefined IPS patterns included in the device cover common attacks while Custom IPS Patterns protect your network from uncommon attacks that are due to the use of proprietary server, custom protocol, or specialized applications used in the corporate network.

Note: Administrator can create Custom IPS Pattern and configure policies using them. However, the IPS scanning will be effective only if 'Network Protection' module is subscribed.

The page provides option to add a new IPS pattern, update the parameters of existing pattern, or delete the pattern.

Add IPS Pattern

The Add IPS Pattern page allows you to add a new Custom IPS Pattern.

Sophos XG Firewall | Protect | 394

1. Go to to Protect > Intrusion Prevention > Custom IPS Signatures and click Add.

2. Enter the IPS Signature details.

Name

Enter a name to identify the Custom IPS Signature.

Protocol

Select IPS protocol from the list.

Available Options:TCPUDPICMPALL

Custom Rule

Specify IPS Signature definition.

Signature definition must begin with a keyword followed by the value enclosed between the double quotes and must end with semicolon (;)

Format: Keyword: "value";

For example, content: "USER JOHN";

If traffic with the content USER JOHN is detected, action defined in the policy will be taken.

Refer to Appendix B – IPS - Custom IPS Pattern Syntax for more details on creating IPS Pattern.

Severity

Select the level of severity from the available options.CriticalMajorModerateMinorWarning

Recommended Action

Specify action to be taken on the selected policy when matching pattern is found.

Available Actions:

Allow Packet - Check each packet before taking action. Drop Packet - Drop packets. Drop Session

- Terminate entire session instead of scanning all the session packets to save resources and avoid getting high number of alerts. Reset - Send TCP reset packet to the originator. Bypass Session -

Scan initial packets only. If the initial packets match the pattern then the rest of the session packets are not scanned and the traffic is allowed to pass.

In all the cases, device generates the log and alerts the Network Administrator.

Figure 368: Add Custom IPS Signature

3. Click Save.

DoS & Spoof Prevention

Sophos XG Firewall | Protect | 395

The device provides several security options that cannot be defined by the security policies. This includes protection from several kinds of “Denial of Service attacks”. These attacks disable computers and circumvent security.

A Denial of Service (DoS) attack is a method that hackers use to prevent or deny legitimate users access to a service.

DoS attacks are typically executed by sending many request packets to a targeted server (usually Web, FTP, or Mail server), which floods the server's resources, making the system unusable. Their goal is not to steal the information but disable or deprive a device or network so that users no longer have access to the network services/resources.

All servers can handle a traffic volume up to a maximum, beyond which they become disabled. Hence, attackers send a very high volume of redundant traffic to a system so it cannot examine and allow permitted network traffic. Best way to protect against the DoS attack is to identify and block such redundant traffic. Below are some DoS settings which can be used for identifying DoS attack:

Packet rate per Source

Total number of connections or packets allowed to a particular user.

Burst rate per Source

Maximum number of packets allowed to a particular user at a given time.

Packet rate per Destination

Total number of connections or packets allowed from a particular user.

Burst rate per Destination

Maximum of packets allowed from a particular user at a given time.

How it works

When the burst rate is crossed, the device considers it as an attack. The device provides DoS attack protection by dropping all the excess packets from the particular source/destination. The device will continue to drop the packets till the attack subsides. Because the device applies threshold value per IP address, traffic from the particular source/ destination will only be dropped while the rest of the network traffic will not be dropped at all.

Time taken to re-allow traffic from the blocked source/destination = time taken to subside the attack + 30 seconds

For example:

Packet rate per source: 100 packets per second

Burst rate per source: 200 packets per second

When the user starts sending requests, initially he will be able to send 200 packets per second but once the 200 packets are received, in the next phase the user will only be able to send 100 packets per second. So in the next phase, if the user sends 150 packets per second, the device will consider it as an attack and drop 50 (150 -100) packets. The device will then only accept traffic from the user 30 seconds after having dropped the packets.

Threshold values

The device uses packet rate and burst rate values as a threshold value to detect DoS attacks. These values depend on various factors like:

• Network bandwidth

• Nature of traffic

• Capacity of servers in the network

These values are applicable to the individual source or destination requests per user/IP address and not globally to the entire network traffic. For example, if the source rate is 2500 packets/minute and the network consists of 100 users then each user is allowed a packet rate of 2500 packets per minute

Configuring high values will degrade the performance and too low values will block the regular requests. Hence it is very important to configure appropriate values for both source and destination IP address.

Sophos XG Firewall | Protect | 396

Spoof Protection General Settings

You can configure a MAC and/or IP address pair entry in the IP-MAC trusted list to improve the security of your network. Using MAC address filtering makes it more difficult for a hacker to guess and use a random MAC address or spoof a MAC address to gain access to your network as the traffic does not even reach your firewall.

Similarly, it is also possible to filter packets based on the IP-MAC pair. It prevents hosts which try to violate trusted

IP-MAC. To make the restriction more granular, you can enable restriction on the zones.

Enable Spoof Prevention

If enabled, the device provides 3 ways to prevent spoofing using an IP-MAC trusted list:

• IP Spoofing – Packets will be dropped if a matching route entry is not available.

• MAC Filter – Packets will be dropped if the MAC addresses are not configured as trusted

MAC.

• IP-MAC Pair Filter – Packets will be dropped if either IP or MAC address does not match with any entry in the IP-MAC trusted list. Packets will be allowed if both IP and MAC address are not defined as an entry in the IP-MAC trusted list.

Restrict Unknown IP on Trusted MAC (Only applicable if Spoof Prevention is enabled)

Enable the option, if you want to drop traffic from any IP address not in the trusted list for the trusted MAC address.

By default, it is disabled. When disabled, traffic from any IP address not in the trusted list will be allowed even if it is coming for the trusted MAC address.

Zone

IP Spoofing

LAN

Yes

Enable at least for one zone.

The device will reverse lookup for the route of the source network and, if not available, packets will be dropped and logged.

Default: disabled for all zones

WAN

No

DMZ

Yes

Sophos XG Firewall | Protect | 397

WiFi

Yes

Zone LAN

MAC Filter

Note: To enable

MAC

Filtering, you need to

add

a trusted

MAC address.

it is

If enabled, to be enabled for at least one zone.

Default: disabled for all zones

Yes all the requests from the

MAC address not configured in the trusted list, please make sure

It restricts the access of your network to the external hosts.

As the device will drop to include

MAC addresses of all your internal devices.

WAN

Yes

DMZ

Yes

Sophos XG Firewall | Protect | 398

WiFi

Yes

Zone

IP-MAC

Pair Filter

LAN

Yes

• MAC address differs for the trusted

IP address and

• IP address differs for the trusted

MAC address

The device will drop the request considering it as a spoofed request if: it is

If enabled, to be enabled for at least one zone.

Default: disabled for all zones

IP-

MAC pair does not exist in the trusted list.

in the list.

Request is dropped if the

But, the request will be allowed if

IP or

MAC address does not exist at all

WAN

No

DMZ

Yes

Sophos XG Firewall | Protect | 399

WiFi

Yes

Sophos XG Firewall | Protect | 400

Figure 369: Spoof Protection General Settings

Spoof Protection Trusted MAC

You can enable MAC address and/or IP address pair filtering to improve security. By enabling filtering, you define the devices that can access your network. It is also possible to import the trusted MAC list through a CSV (Comma

Separated Value) file. When a user attempts to access the network, the device checks the MAC address and/or IP address from the list. User gets access to the network only if the MAC address and/or IP address are in the trusted

MAC list, else the request is rejected.

The Spoof Prevention Trusted MAC section displays a list of all the MAC addresses configured as trusted MAC.

The page also provides options to

add

a new MAC address, update the existing addresses, and

import

the list of addresses.

DoS Settings

Attack definition can be defined both for source and destination.

SYN Flood

SYN Flood is the attack in which large numbers of connections are sent so that the backlog queue overflows. The connection is created when the victim host receives a connection request and allocates some memory resources to it. A SYN flood attack creates so many half-open connections that the system becomes overwhelmed and cannot handle incoming requests any more.

Configure packet rate (packets/minute) and burst rate (packets/second) for source and destination.

Select Apply Flag check box to apply the SYN flood definition and control the allowed number of packets.

Source Traffic Dropped displays number of source packets dropped in case source packet rate control is applied.

Destination Traffic Dropped displays the number of packets dropped in case destination packet rate control is applied

Click on the link Click Here to view DoS attacks status. You will be redirected to Protect >

Intrusion Prevention > DoS Attacks. Then click SYN Flood to view the real-time updates on flooding. It displays the source IP address - which was used for flooding and IP address which was targeted.

UDP Flood

User Datagram Protocol (UDP) Flood links two systems. It hooks up one system’s UDP charactergenerating service, with another system’s UDP echo service. Once the link is made, the two systems are tied up exchanging a flood of meaningless data.

Configure packet rate (packets/minute) and burst rate (packets/second) for source and destination.

Select Apply Flag check box to apply the UDP flood definition and control the allowed number of packets.

Sophos XG Firewall | Protect | 401

Source Traffic Dropped displays the number of source packets dropped in case source packet rate control is applied.

Destination Traffic Dropped displays the number of packets dropped in case destination packet rate control is applied

Click on the link Click Here to view DoS attacks status. It will redirect you to Protect > Intrusion

Prevention > DoS Attacks and Click UDP Flood to view the real-time updates on flooding. It displays the source IP address - which was used for flooding and IP address which was targeted.

TCP Flood

TCP attack sends huge amount of TCP packets so that the host/victim computer cannot handle, thereby denying service to legitimate TCP users.

Configure packet rate (packets/minute) and burst rate (packets/second) for source and destination.

Select Apply Flag check box to apply the TCP flood definition and control the allowed number of packets.

Source Traffic Dropped displays the number of source packets dropped in case source packet rate control is applied.

Destination Traffic Dropped displays the number of packets dropped in case destination packet rate control is applied

ICMP/ICMPv6 Flood

ICMP/ICMPv6 attack sends huge amounts of packet/traffic so that the protocol implementation of the host/victim computer cannot handle, thereby preventing legitimate packets from getting through to their destination.

Configure packet rate (packets/minute) and burst rate (packets/second) for source and destination.

Select Apply Flag check box to apply the ICMP flood definition and control the allowed number of packets.

Source Traffic Dropped displays the number of source packets dropped in case source packet rate control is applied.

Destination Traffic Dropped displays the number of packets dropped in case destination packet rate control is applied

Click on the link Click Here to view DoS attacks status. It will redirect you to Protect > Intrusion

Prevention > DoS Attacks and Click ICMP/ICMPv6 Flood to view the real-time updates on flooding. It displays the source IP address - which was used for flooding and IP address which was targeted.

Dropped Source Routed Packets

Select Apply Flag check box to enable. This will block any source routed connections and prevent any packets with an internal address from entering your network.

Disable ICMP/ICMPv6 Redirect Packet

An ICMP redirect packet is used by routers to inform the hosts what the correct route should be. If an attacker is able to forge ICMP redirect packets, he or she can alter the routing tables on the host and possibly weaken the security of the host by causing traffic to flow via another path.

Disable the option to prevent the attacker from forging ICMP redirect packets.

Default: enabled

ARP Hardening

If enabled, the device will send an ARP reply only if the destination IP address is a local address configured on the incoming interface and both the sender and destination IP address are in the same subnet.

Sophos XG Firewall | Protect | 402

Figure 370: DoS Settings

DoS Bypass Rule

The device allows to bypass the DoS rule in case you are sure that the specified source will not be used for flooding or the device ignores flooding coming from the specified source. By default, VPN zone traffic is also subjected to

DoS inspection. You can also bypass DoS inspection of the traffic coming from certain hosts of the VPN zone.

The DoS Bypass Rule section displays a list of all the bypass rule.

Add a Trusted MAC Address

This page allows you to add a trusted MAC address.

1. Go to Protect > Intrusion Prevention > DoS & Spoof Protectionand click Add under the Spoof Protection

Trusted MAC section.

2. Enter trusted MAC address details.

MAC Address

Specify a MAC address to be added to the Trusted MAC list.

IPv4 Address

Specify an IPv4 address that is to be bound to the MAC address. Packets will be rejected if either

MAC or IPv4 address does not match.

Available Options:Static – Specify an IP Address to be bound to the MAC address. Packets will be rejected if either MAC or IP address does not match. Multiple IP addresses separated by comma can be provided.DHCP – MAC address will be bound to the IP address leased by the device DHCP server as and when the IP is leased. Entry will be updated automatically when the leased IP address is updated.

To unbind the IPv4 address, select None.

IPv6 Address

Specify an IPv6 address that is to be bound to the MAC address. Packets will be rejected if either

MAC or IPv6 address does not match.

Available Options:Static – Specify an IP Address to be bound to the MAC address. Packets will be rejected if either MAC or IP address does not match. Multiple IP addresses separated by comma can be provided.DHCP – MAC address will be bound to the IP address leased by the device DHCP server as and when the IP is leased. Entry will be updated automatically when the leased IP address is updated.

To unbind the IPv6 address, select None.

Sophos XG Firewall | Protect | 403

Figure 371: Add Trusted MAC

3. Click Save.

Import Trusted MAC Addresses

Instead of adding the trusted entries individually, the device provides a facility to import the trusted list from a CSV

(Comma Separated Value) file.

The format for the CSV file should be as follows:

1. First row of the CSV file has to be the header row: MAC address, IP association, IP address.

2. The rest of the rows are values corresponding to the header fields .

3. Blank rows will be ignored.

4. An error message is displayed only for invalid rows.

5. Format of values:

• Compulsory fields: MAC address and IP association.

• Optional fields: IP address.

• IP association must be Static or DHCP or None.

• For Static IP association, IP address must be available.

• For None/DHCP type of IP association, IP address is not required.

• For invalid MAC/IP address or IP association entry will be discarded.

• Use comma to insert multiple static IP addresses.

1. Go to Protect > Intrusion Prevention > DoS & Spoof Protectionand click Import under the Spoof Protection

Trusted MAC section to import a CSV file.

2. Browse trusted MAC address file.

Trusted MAC Address File

To choose a CSV file, click the file selection button against Trusted MAC Address File.

3. Click Upload File to upload CSV file.

Figure 372: Import Trusted MAC Address CSV File

Create a DoS Bypass Rule

This page allows you to create a DoS bypass rule.

Sophos XG Firewall | Protect | 404

1. Go to Protect > Intrusion Prevention > DoS & Spoof Protection and click Add under the DoS Bypass Rule section.

2. Enter bypass rule details.

IP Family

Select the IP family of the traffic to be bypassed.

Source IP/Netmask (available only if selected IP Family is IPv4)

Specify the source IP/Netmask.

Specify * if you want to bypass entire network.

Destination IP/Netmask (available only if selected IP Family is IPv4)

Specify the destination IP/Netmask.

Specify * if you want to bypass entire network.

Source IP/Prefix (available only if selected IP Family is IPv6)

Specify the source IP/prefix.

Specify * if you want to bypass entire network.

Destination IP/Prefix (available only if selected IP Family is IPv6)

Specify the destination IP/prefix.

Specify * if you want to bypass entire network.

Protocol

Select the protocol whose traffic is to be bypassed if generated from the specified source to destination.

Available Options:TCPUDPICMPAll Protocols

For example, if you select TCP protocol then DoS rules will not be applied on the TCP traffic from the specified source to destination.

Source Port

Specify port number for the source.

Specify * if you want to bypass entire network.

Destination Port

Specify port number for the destination.

Specify * if you want to bypass entire network.

Figure 373: Add DoS Bypass Rule

3. Click Save.