WEBVTT - This file was automatically generated by VIMEO 1 00:00:06.900 --> 00:00:09.600 YouTube video for an operation of 2 00:00:09.600 --> 00:00:12.500 Cisco, Firepower, IDs of 3 00:00:12.500 --> 00:00:15.300 Grace, this video will see how 4 00:00:15.300 --> 00:00:19.100 to configure the IPS policy and its 5 00:00:18.100 --> 00:00:21.800 policy to access policy on 6 00:00:21.800 --> 00:00:22.900 a Cisco firewall. 7 00:00:30.100 --> 00:00:32.000 Call. 8 00:00:37.100 --> 00:00:40.500 When Cody Grainger 9 00:00:40.500 --> 00:00:43.600 solution Francisco, I want 10 00:00:43.600 --> 00:00:47.700 to go see Goldie IPS policy as 11 00:00:46.700 --> 00:00:49.300 part of a Cisco. Firewall is 12 00:00:49.300 --> 00:00:55.100 actually based on the North Star in 13 00:00:54.100 --> 00:00:57.500 one of 14 00:00:57.500 --> 00:01:00.800 those. If even one of 15 00:01:00.800 --> 00:01:04.100 one of the most part, most 16 00:01:03.100 --> 00:01:07.200 known IPS on the market. And 17 00:01:06.200 --> 00:01:09.300 the snort is used as a base to too 18 00:01:09.300 --> 00:01:12.900 many other material talkin 19 00:01:12.900 --> 00:01:15.900 about Cisco and Cisco's. I actually using ganap 20 00:01:15.900 --> 00:01:18.600 the door to tell he's not engine. 21 00:01:18.600 --> 00:01:21.600 But is there IPS part of the product is 22 00:01:21.600 --> 00:01:24.300 actually based on a search fire and it's a 23 00:01:24.300 --> 00:01:28.900 result of these calls a position of a sourcefire ago. 24 00:01:27.900 --> 00:01:30.200 And so far 25 00:01:30.200 --> 00:01:34.300 is a commercial version of open-source idea. Yes, 26 00:01:33.300 --> 00:01:36.500 sir, everything. Good in all the 27 00:01:36.500 --> 00:01:36.900 terminology. 28 00:01:37.100 --> 00:01:41.100 Cisco. IP configuration are 29 00:01:40.100 --> 00:01:42.600 actually Nordstrom now. 30 00:01:43.700 --> 00:01:46.300 Configure g into return 31 00:01:46.300 --> 00:01:55.800 policy. I forgot 32 00:01:55.800 --> 00:01:58.300 to mention. I'm working this through the 33 00:01:58.300 --> 00:02:03.300 fire power management center regarding Cisco. 34 00:02:02.300 --> 00:02:05.500 I'm going to show her. There will 35 00:02:05.500 --> 00:02:09.600 be based on a $5 minimum. So let's create 36 00:02:09.600 --> 00:02:14.400 a new policy IDs. 37 00:02:14.800 --> 00:02:18.200 Do I 38 00:02:18.200 --> 00:02:22.200 have an option? But I 39 00:02:22.200 --> 00:02:25.600 suggest if this is IPS deployed on a traffic 40 00:02:25.600 --> 00:02:28.500 to run, there were no IPS before I 41 00:02:28.500 --> 00:02:31.300 suggest to turn off this option, but it's often 42 00:02:31.300 --> 00:02:34.300 means this, every dropping in line means that they, I guess 43 00:02:34.300 --> 00:02:37.500 we'll be working in the intrusion prevention. 44 00:02:37.500 --> 00:02:41.400 Dipstix, Raleigh 45 00:02:40.400 --> 00:02:43.300 block after if it 46 00:02:43.300 --> 00:02:47.100 detects, don't leave this option, signed and 47 00:02:47.100 --> 00:02:51.400 faxed, and they gave us an idea for a 48 00:02:51.400 --> 00:02:56.800 traffic covered by turn it 49 00:02:56.800 --> 00:02:59.400 off when we apply to 50 00:02:59.400 --> 00:03:02.100 the traffic. So I saved a few weeks and then 51 00:03:02.100 --> 00:03:05.300 after a few Casino results, we can see 52 00:03:05.300 --> 00:03:08.300 if there are any false positives and Stuart are 53 00:03:08.300 --> 00:03:11.900 going to be some Pokemon seasons and price. You 54 00:03:11.900 --> 00:03:13.700 earlier, we need to remove. 55 00:03:14.800 --> 00:03:17.600 By carefully tuning, the signatures and 56 00:03:17.600 --> 00:03:27.900 the rest of the IP address to a place from 57 00:03:27.900 --> 00:03:31.000 which this policy will originated. There 58 00:03:30.400 --> 00:03:33.900 are several complaints about security and 59 00:03:33.900 --> 00:03:36.300 connectivity is according, to its 60 00:03:36.300 --> 00:03:40.100 name. It's something balance. You are 61 00:03:39.100 --> 00:03:42.200 reasonable set of signature, has 62 00:03:42.200 --> 00:03:45.700 been able to provide enough level security, but it 63 00:03:45.700 --> 00:03:49.000 will not be too restrictive on some signatures that 64 00:03:48.100 --> 00:03:53.100 I'm taking care about something like 65 00:03:52.100 --> 00:03:59.100 that because it's you for a 66 00:03:59.100 --> 00:04:04.300 connectivity and border security only latest 67 00:04:03.300 --> 00:04:06.700 signature, a seasonal color. Only latest 68 00:04:06.700 --> 00:04:10.300 attacks. I don't know maybe a few years old. Call 69 00:04:09.300 --> 00:04:11.100 her and if he 70 00:04:14.800 --> 00:04:17.400 Her security is now in 71 00:04:17.400 --> 00:04:20.200 the second planet, send a background. It's 72 00:04:20.200 --> 00:04:29.900 the priorities are going to be. For the 73 00:04:29.900 --> 00:04:32.800 most critical task will not 74 00:04:32.800 --> 00:04:36.700 be an able to set the 75 00:04:36.700 --> 00:04:41.000 national drop the town. Of course, 76 00:04:40.400 --> 00:04:44.000 we have the screen situation 77 00:04:43.600 --> 00:04:46.700 because you messing with actions than almost all 78 00:04:46.700 --> 00:04:49.500 to get yours will be turned on. Block of 79 00:04:49.500 --> 00:04:54.900 them, will be extra traffic to 4630, B 80 00:04:54.900 --> 00:04:57.700 coverage for even an option to attack us at 81 00:04:57.700 --> 00:05:00.700 the best way 82 00:05:00.700 --> 00:05:04.200 to start with. All right? Going 83 00:05:04.200 --> 00:05:08.200 to take you still up all these mandatory 84 00:05:07.200 --> 00:05:10.400 so we can become the create 85 00:05:10.400 --> 00:05:10.800 and edit. 86 00:05:26.700 --> 00:05:29.600 Floating the signatures of baseball. 87 00:05:35.300 --> 00:05:36.700 Call Moe's on. 88 00:05:38.500 --> 00:05:42.600 Now we have menu. We 89 00:05:41.600 --> 00:05:44.600 have the options, which we 90 00:05:44.600 --> 00:05:47.600 always have whenever we decide to 91 00:05:47.600 --> 00:05:50.800 turn off 92 00:05:50.800 --> 00:05:53.800 in line or the IPS mod. 93 00:05:53.800 --> 00:05:57.100 We can change the monster security 94 00:05:56.100 --> 00:05:57.700 and prosperity. 95 00:05:58.800 --> 00:06:02.400 Signature updates are recent. It's 96 00:06:01.400 --> 00:06:08.000 only one day off, which is still a 97 00:06:07.200 --> 00:06:10.400 policy policy has 98 00:06:10.400 --> 00:06:15.000 been 8928. New Jersey of 99 00:06:14.100 --> 00:06:17.200 these rules will drop actually in 100 00:06:17.200 --> 00:06:22.600 generator events. Only a minority of blue generate, 101 00:06:20.600 --> 00:06:24.400 a course. It 102 00:06:24.400 --> 00:06:28.200 depends. If you are turned off, Brooklyn, NY Nola, let's 103 00:06:27.200 --> 00:06:30.100 go see what we can 104 00:06:30.100 --> 00:06:35.500 do here. It's not 105 00:06:35.500 --> 00:06:38.900 the technology call North Rose, srr through 106 00:06:38.900 --> 00:06:41.700 update, s r, a u or a small to update 107 00:06:41.700 --> 00:06:44.900 is in the version of signature database 108 00:06:44.900 --> 00:06:48.700 and snort rules are call IPS signature 109 00:06:48.700 --> 00:06:55.000 in organized by 110 00:06:54.800 --> 00:06:56.500 the categories or classifications. 111 00:06:58.800 --> 00:07:04.100 The example 112 00:07:03.100 --> 00:07:06.700 is the status of it says 113 00:07:06.700 --> 00:07:09.700 it's rotated. If it's gray Arrow, 114 00:07:09.700 --> 00:07:13.900 it means we can 115 00:07:13.900 --> 00:07:17.500 change. It can play dropping 116 00:07:16.500 --> 00:07:23.800 generated in this. So 117 00:07:19.800 --> 00:07:23.900 we 118 00:07:23.900 --> 00:07:26.500 see in our tax symbol symbol means 119 00:07:26.500 --> 00:07:29.400 that the signature is it's triggered by 120 00:07:29.400 --> 00:07:32.200 traffic if you generate Evans, but it will also 121 00:07:32.200 --> 00:07:33.300 drop the traffic. 122 00:07:35.900 --> 00:07:38.700 Okay, if it's only generate events 123 00:07:38.700 --> 00:07:41.600 will see just an arrow, but it will not be graded 124 00:07:41.600 --> 00:07:48.900 long week. We're right by your old house needs 125 00:07:48.900 --> 00:07:56.100 to problem. Then 126 00:07:54.100 --> 00:07:59.700 North through 127 00:07:59.700 --> 00:08:03.800 the Red Sea alarm to phone decided that 128 00:08:03.800 --> 00:08:06.600 this is not a race for your organization than you 129 00:08:06.600 --> 00:08:09.300 will simply choose an action of 130 00:08:09.300 --> 00:08:11.400 alert, only, or disabled. 131 00:08:14.900 --> 00:08:17.600 I said the beginning 132 00:08:17.600 --> 00:08:21.000 you might 133 00:08:20.300 --> 00:08:24.500 experience is that is some users reported 134 00:08:23.500 --> 00:08:26.600 that their applications are not 135 00:08:26.600 --> 00:08:32.200 working anymore. That you 136 00:08:32.200 --> 00:08:35.800 are a Cisco, IP address is blocking traffic. And if 137 00:08:35.800 --> 00:08:41.300 you do not see anything else, is 138 00:08:41.300 --> 00:08:44.600 not working because we have 139 00:08:44.600 --> 00:08:52.500 something to show 140 00:08:52.500 --> 00:08:52.500 you. 141 00:09:00.100 --> 00:09:03.400 Analyze its policy. There is 142 00:09:03.400 --> 00:09:06.900 a default on license policy, but we can complete our own 143 00:09:06.900 --> 00:09:09.400 just for 144 00:09:09.400 --> 00:09:14.600 the best 145 00:09:13.600 --> 00:09:16.500 practice to follow the same time 146 00:09:16.500 --> 00:09:25.600 place. There is no direct spending on 147 00:09:25.600 --> 00:09:28.500 each other as a baseball c 148 00:09:28.500 --> 00:09:31.300 e, n d. I p s policy to choose the balance of 149 00:09:31.300 --> 00:09:34.800 security are connectivity or whatever you choose the best practices 150 00:09:34.800 --> 00:09:38.600 to destroys during 151 00:09:37.600 --> 00:09:41.400 the creation of paperwork online. If you 152 00:09:41.400 --> 00:09:45.200 do not create a nest account is policy. There is no, default account 153 00:09:44.200 --> 00:09:49.400 is policy in place and that's 154 00:09:47.400 --> 00:09:50.700 where coronavirus is Portuguese 155 00:09:50.700 --> 00:09:53.700 for an important part 156 00:09:53.700 --> 00:09:57.000 of a snore and it's actually deals 157 00:09:56.300 --> 00:09:59.200 with normalizing traffic. What does 158 00:09:59.200 --> 00:09:59.600 mean? 159 00:10:00.100 --> 00:10:03.500 Different operating systems on different 160 00:10:03.500 --> 00:10:07.600 application, different layers 161 00:10:07.600 --> 00:10:10.700 of data, our data, transfer 162 00:10:10.700 --> 00:10:14.500 it over different layers. Wi-Fi, Communications tech 163 00:10:14.500 --> 00:10:17.300 difference. Between example, if we 164 00:10:17.300 --> 00:10:20.700 have HTTP server, for example, Linux Apache, maybe 165 00:10:20.700 --> 00:10:23.900 some HDPE or you are all the 166 00:10:23.900 --> 00:10:27.100 research information address 167 00:10:26.100 --> 00:10:30.600 and coding is different and 168 00:10:29.600 --> 00:10:32.500 very busy of operating systems. So 169 00:10:32.500 --> 00:10:36.300 the IPS. Just 170 00:10:35.300 --> 00:10:39.000 mentioned that we do not have the Dupree Professor 171 00:10:38.600 --> 00:10:46.400 solder, never coronavirus policy to bypass 172 00:10:45.400 --> 00:10:47.500 the IPS to White 173 00:10:50.800 --> 00:10:54.000 Buy American League, changing the encoding. So 174 00:10:53.400 --> 00:10:56.500 I miss placing some characters in 175 00:10:56.500 --> 00:10:59.700 the URL. You can actually make that IPS 176 00:10:59.700 --> 00:11:02.700 not recognize the pattern is looking for 177 00:11:02.700 --> 00:11:05.800 your tax. Return is looking for her. The destination 178 00:11:05.800 --> 00:11:09.000 server as a victim who recognizes because if 179 00:11:08.500 --> 00:11:11.600 her nose is running 180 00:11:11.600 --> 00:11:15.100 the Apache server version particular version 181 00:11:14.100 --> 00:11:19.800 will recognize 182 00:11:19.800 --> 00:11:22.600 us. If we have some string that you'll trigger some 183 00:11:22.600 --> 00:11:25.500 Buffalo security bag and try 184 00:11:25.500 --> 00:11:28.500 to sway, you should draft this year all 185 00:11:28.500 --> 00:11:31.800 at orenco this quest for the server that 186 00:11:31.800 --> 00:11:37.400 carefully because it's 187 00:11:34.400 --> 00:11:37.500 based 188 00:11:37.500 --> 00:11:40.600 on different operating system and doesn't want 189 00:11:40.600 --> 00:11:43.100 everything on every character in the 190 00:11:43.100 --> 00:11:46.200 packet, everything in the pocket in a table. Look like it's 191 00:11:46.200 --> 00:11:49.200 unnecessary. The same as the victim of, 192 00:11:49.200 --> 00:11:49.600 Utah. 193 00:11:50.600 --> 00:11:53.400 That's why I don't pray processors and they're doing a normalization. 194 00:11:53.400 --> 00:11:56.800 Normalization is actually a modification of 195 00:11:56.800 --> 00:11:59.100 this and calling card. Contents of the 196 00:11:59.100 --> 00:12:09.900 package ideas is able to Target. These 197 00:12:09.900 --> 00:12:12.100 are some parameters. You know, how do you say, 198 00:12:12.100 --> 00:12:16.900 what type 199 00:12:15.900 --> 00:12:19.100 of encoding actually? What 200 00:12:18.100 --> 00:12:22.100 to do with the compressed data and structural what 201 00:12:21.100 --> 00:12:26.300 to do with the Afghan clothing and we do 202 00:12:26.300 --> 00:12:39.300 not have the time to go to the auction. But no, 203 00:12:39.300 --> 00:12:40.800 we haven't forget the ocean. 204 00:12:46.300 --> 00:12:49.300 IP address. 205 00:12:51.700 --> 00:12:54.400 Call. I can consider these options 206 00:12:54.400 --> 00:12:57.400 for that particular server, so that 207 00:12:57.400 --> 00:13:00.500 you find the operating system. If I know these details, 208 00:13:00.500 --> 00:13:04.000 I can say, okay. This is, this 209 00:13:03.300 --> 00:13:10.300 is an Apache server. So the traffic going 210 00:13:09.300 --> 00:13:12.700 to this particular IP address 211 00:13:12.700 --> 00:13:21.700 that the 212 00:13:21.700 --> 00:13:24.500 potential attacker is sending to the server, 213 00:13:24.500 --> 00:13:28.200 in the same server 214 00:13:27.200 --> 00:13:31.700 or the weekend will be more accurate 215 00:13:31.700 --> 00:13:36.500 normalization. Your 216 00:13:35.500 --> 00:13:37.700 server will be protected. 217 00:13:41.200 --> 00:13:44.300 This contributes to a reduction of 218 00:13:44.300 --> 00:13:48.300 false positive. Are we can have just showing 219 00:13:47.300 --> 00:13:50.200 you an example for hdb, but you can 220 00:13:50.200 --> 00:13:54.200 have it for different products. 221 00:13:53.200 --> 00:13:57.400 What's important 222 00:13:57.400 --> 00:14:00.600 here? If you can feel something here, 223 00:14:00.600 --> 00:14:03.600 you are. Starting to experience some 224 00:14:03.600 --> 00:14:07.500 issues, posting their application might 225 00:14:06.500 --> 00:14:10.200 need to go to the casino. 226 00:14:09.200 --> 00:14:10.600 I mean, 227 00:14:12.900 --> 00:14:16.800 Process of selection process of 228 00:14:16.800 --> 00:14:19.900 doing the 229 00:14:19.900 --> 00:14:22.900 HTTP normalization configuration, 230 00:14:22.900 --> 00:14:27.000 turn on 231 00:14:26.300 --> 00:14:30.600 all the 232 00:14:30.600 --> 00:14:35.000 signatures handling, the normalisation process 233 00:14:34.500 --> 00:14:45.100 of for http, stand for 234 00:14:44.100 --> 00:14:48.400 your application because the 235 00:14:47.400 --> 00:14:51.300 drops traffic. 236 00:14:50.300 --> 00:14:53.800 If they are unable to normalize, if they see 237 00:14:53.800 --> 00:15:02.100 some animals besides the 238 00:15:01.100 --> 00:15:04.700 optimization normalization of accountant, 239 00:15:04.700 --> 00:15:07.100 there actually are looking for a 240 00:15:07.100 --> 00:15:07.400 normal. 241 00:15:12.900 --> 00:15:20.400 The signature, you 242 00:15:15.400 --> 00:15:20.700 need 243 00:15:20.700 --> 00:15:23.700 to enable Tickler process of signatures 244 00:15:23.700 --> 00:15:27.500 78 generator, 245 00:15:26.500 --> 00:15:32.500 Northern Tool. Oiler. Also, 246 00:15:30.500 --> 00:15:34.400 keep in mind, that whatever 247 00:15:33.400 --> 00:15:36.800 action, you choose. You cannot 248 00:15:36.800 --> 00:15:39.600 prevent walking out this traffic. So you cannot prevent 249 00:15:39.600 --> 00:15:42.300 blocking up, traffic calls by processor food 250 00:15:42.300 --> 00:15:50.000 processor, or you will 251 00:15:49.100 --> 00:15:52.300 not see anything in the log starting disc, 252 00:15:52.300 --> 00:15:57.400 but you have a draft draft, a normal 253 00:15:55.400 --> 00:15:59.700 to not 254 00:15:59.700 --> 00:16:04.100 block, just a lark, make people feel. This is 255 00:16:04.100 --> 00:16:07.500 something that you need to be aware of for the 256 00:16:07.500 --> 00:16:10.500 men beginning. And if you are not experienced North 257 00:16:10.500 --> 00:16:12.400 user, I would suggest 258 00:16:12.800 --> 00:16:15.900 Natasha Network analyzers policy only after 259 00:16:15.900 --> 00:16:18.800 a few weeks when you see, when you 260 00:16:18.800 --> 00:16:21.300 filter the false positives caused by 261 00:16:21.300 --> 00:16:26.400 normal, you can start 262 00:16:25.400 --> 00:16:29.800 playing with three professors to your IPS 263 00:16:29.800 --> 00:16:37.900 security. Bipolar, 264 00:16:32.900 --> 00:16:38.900 recommendation, 265 00:16:37.900 --> 00:16:46.000 or recommendations are operating 266 00:16:41.000 --> 00:16:46.000 system 267 00:16:46.400 --> 00:16:53.000 and application for a 268 00:16:52.500 --> 00:16:55.100 purpose of prioritizing the 269 00:16:55.100 --> 00:17:02.100 hours for Microsoft, the 270 00:17:02.100 --> 00:17:08.000 IRS, or we have a server without application. 271 00:17:05.000 --> 00:17:09.400 If 272 00:17:08.400 --> 00:17:12.000 this IP 273 00:17:11.000 --> 00:17:12.400 address 274 00:17:12.800 --> 00:17:15.400 Talk to the Apache 275 00:17:15.400 --> 00:17:20.600 live version of a specific word for This 276 00:17:20.600 --> 00:17:38.600 Server. As places 277 00:17:38.600 --> 00:17:42.300 that this attack, was aimed against 278 00:17:41.300 --> 00:17:45.100 the Apache, web 279 00:17:44.100 --> 00:17:50.000 server, and discuss this case, 280 00:17:49.500 --> 00:17:53.400 the IPS lower higher alert, 281 00:17:53.400 --> 00:17:56.300 because obviously knows what 282 00:17:56.300 --> 00:18:00.200 she's doing is using the right tool for the right Target 283 00:17:59.200 --> 00:18:03.200 and look. 284 00:18:03.200 --> 00:18:06.300 If the alert is action for the 285 00:18:06.300 --> 00:18:06.800 rule. 286 00:18:12.800 --> 00:18:15.600 But if 287 00:18:15.600 --> 00:18:18.700 the rules and the 288 00:18:18.700 --> 00:18:22.100 attack and services in 289 00:18:22.100 --> 00:18:25.100 this is the 290 00:18:25.100 --> 00:18:29.400 critical alert and the IPS jewelry Mark richt ain't 291 00:18:29.400 --> 00:18:34.400 in your wallet indication of 292 00:18:34.400 --> 00:18:40.200 compromise, and the 293 00:18:40.200 --> 00:18:43.900 attack was meant to the operating system and application, which 294 00:18:43.900 --> 00:18:48.400 is probably. So 295 00:18:47.400 --> 00:18:50.200 you need to give a 296 00:18:50.200 --> 00:19:01.400 high priority to this. What's my 297 00:19:01.400 --> 00:19:06.900 abilities, your horse to, or trying to protect accommodate alert. 298 00:19:06.900 --> 00:19:09.700 So he can be a very smart and 299 00:19:09.700 --> 00:19:10.800 very secure system. 300 00:19:12.700 --> 00:19:16.800 It's not 301 00:19:16.800 --> 00:19:22.400 something that you can forget recommend. We 302 00:19:21.400 --> 00:19:24.500 do not have an integration with the 303 00:19:24.500 --> 00:19:28.400 management system 304 00:19:27.400 --> 00:19:31.600 or pension system needs to 305 00:19:31.600 --> 00:19:34.700 learn the operating system in applications 306 00:19:34.700 --> 00:19:55.500 from a traffic by using 307 00:19:55.500 --> 00:20:04.600 the network, discovery policy submit watch 308 00:20:03.600 --> 00:20:06.400 and when we submit to try 309 00:20:06.400 --> 00:20:09.200 to discover the horses covered the operating system and 310 00:20:09.200 --> 00:20:12.500 application some costs, by observing attract. 311 00:20:12.700 --> 00:20:15.400 Call my default if there is any network, 312 00:20:15.400 --> 00:20:19.600 but I recommend you turn right to modify this, especially 313 00:20:18.600 --> 00:20:22.000 if this is a perimeter 5 or 314 00:20:21.200 --> 00:20:24.300 so, because you don't want to call her 315 00:20:24.300 --> 00:20:27.200 because he should 316 00:20:27.200 --> 00:20:31.700 discover literally every source and destination IP address for 317 00:20:30.700 --> 00:20:33.700 Jesus. All 318 00:20:33.700 --> 00:20:36.700 actually, it's not a good idea because 319 00:20:36.700 --> 00:20:39.500 database has 320 00:20:39.500 --> 00:20:42.500 a limited amount of space in the database and 321 00:20:42.500 --> 00:20:46.100 tissue are actually 322 00:20:45.100 --> 00:20:49.800 discovering the car. You 323 00:20:48.800 --> 00:20:51.300 can only describe her house that 324 00:20:51.300 --> 00:20:52.100 you are in. 325 00:20:53.000 --> 00:20:56.300 4 months. 326 00:20:56.300 --> 00:20:59.600 Most simplest quickest thing that you can do is just tell me, 327 00:20:59.600 --> 00:21:02.900 okay, just cover, only private IP address. So 328 00:21:02.900 --> 00:21:05.100 do not use the Do Not discard. 329 00:21:07.600 --> 00:21:11.100 Cost you can use the off button applications. 330 00:21:10.100 --> 00:21:13.300 I want to discover a user's, we'll talk about 331 00:21:13.300 --> 00:21:16.600 this when we're going to talk about user ID functionality. 332 00:21:17.600 --> 00:21:20.500 the results you 333 00:21:20.500 --> 00:21:21.700 want to discover, but 334 00:21:22.700 --> 00:21:25.100 Reasons for apartment. I think this 335 00:21:25.100 --> 00:21:30.100 is enough for beginning North. 336 00:21:30.500 --> 00:21:35.500 So now I can turn on Firepower recommendations. 337 00:21:34.500 --> 00:21:37.300 Also be careful 338 00:21:37.300 --> 00:21:40.400 with this option. What happens if 339 00:21:40.400 --> 00:21:45.300 I turn on the music mendacious? I 340 00:21:43.300 --> 00:21:46.400 do not send the 341 00:21:46.400 --> 00:21:55.800 traffic traffic to 342 00:21:52.800 --> 00:21:56.100 General 343 00:21:55.100 --> 00:21:58.800 recommendations, relax regenerates recommendation 344 00:21:58.800 --> 00:22:02.200 database that 345 00:22:01.200 --> 00:22:04.900 he discovered using the 346 00:22:04.900 --> 00:22:07.600 discovery policy. If we seen 347 00:22:07.600 --> 00:22:10.800 before and each will try to 348 00:22:10.800 --> 00:22:13.500 match the operating 349 00:22:13.500 --> 00:22:17.200 systems and applications with the rules in 350 00:22:17.200 --> 00:22:19.100 the policy store Eastvale. 351 00:22:30.400 --> 00:22:33.700 Spare the 352 00:22:33.700 --> 00:22:38.200 memory accept accept the 353 00:22:38.200 --> 00:22:44.800 recommendation to disable, the first database 354 00:22:44.800 --> 00:22:47.600 are not indefinite. So they 355 00:22:47.600 --> 00:22:50.500 have some time to leave. So after the expiration 356 00:22:50.500 --> 00:22:53.300 timer, did the hospital disappear for the 357 00:22:53.300 --> 00:22:59.100 recommendation? You 358 00:22:58.100 --> 00:23:06.700 can schedule recommendation, is that 359 00:23:06.700 --> 00:23:09.300 there is no any cost, any more 360 00:23:09.300 --> 00:23:13.500 stable rules 361 00:23:13.500 --> 00:23:13.800 for? 362 00:23:15.900 --> 00:23:18.400 No, I personally is my IP 363 00:23:18.400 --> 00:23:21.300 address is not over molded. I 364 00:23:21.300 --> 00:23:24.600 will not be sufficient because the risk 365 00:23:24.600 --> 00:23:29.500 of Discovery is not having my baby 366 00:23:29.500 --> 00:23:32.200 son's favorite team, who install a 367 00:23:32.200 --> 00:23:35.600 new server new server and the IPS to 368 00:23:35.600 --> 00:23:38.500 look. Now. It's at the moment, This Server must be 369 00:23:38.500 --> 00:23:41.200 perfect for a while until you 370 00:23:41.200 --> 00:23:45.500 text the traffic here and 371 00:23:45.500 --> 00:23:49.200 use recommendation, sister this to turn on the rules 372 00:23:48.200 --> 00:23:51.700 or operating system and applications 373 00:23:51.700 --> 00:23:55.700 that otherwise might not have a 374 00:23:54.700 --> 00:23:59.600 husband. 375 00:24:03.100 --> 00:24:06.500 Saw this. That's basically it 376 00:24:06.500 --> 00:24:09.800 and need to 377 00:24:09.800 --> 00:24:12.900 go and quick to commit changes. 378 00:24:12.900 --> 00:24:15.700 This means that if I 379 00:24:15.700 --> 00:24:18.300 made this policy are committed and 380 00:24:18.300 --> 00:24:22.400 returned to the database. And now I've tried 381 00:24:21.400 --> 00:24:24.200 to avoid the configuration to my 382 00:24:24.200 --> 00:24:30.400 fire hall in love with an elastic control policy. 383 00:24:29.400 --> 00:24:34.900 For you to the 500 384 00:24:32.900 --> 00:24:36.400 start enforcing, 385 00:24:36.400 --> 00:24:38.600 its rules on my traffic. 386 00:24:39.200 --> 00:24:49.200 Okay. Now I'm creating a policy actually 387 00:24:42.200 --> 00:24:49.300 a 388 00:24:49.300 --> 00:24:52.100 final. 389 00:24:53.600 --> 00:24:56.500 From the perspective of the administration of 390 00:24:56.500 --> 00:25:01.600 the user interface. This makes us truly 391 00:25:01.600 --> 00:25:04.500 next-generation firewall management solution 392 00:25:04.500 --> 00:25:07.200 because he can go into the 393 00:25:07.200 --> 00:25:08.700 access control RC. 394 00:25:14.500 --> 00:25:17.400 I have my reward from last time 395 00:25:17.400 --> 00:25:20.700 and I said, I would like to apply this 396 00:25:20.700 --> 00:25:23.500 policy for this direction, 397 00:25:23.500 --> 00:25:26.600 the policy to 398 00:25:26.600 --> 00:25:29.800 the room number, for which means the Disposable pie 399 00:25:29.800 --> 00:25:32.400 on the traffic entering this room 400 00:25:32.400 --> 00:25:35.400 number. For. This means the traffic from the Internet, is 401 00:25:35.400 --> 00:25:39.300 going to work my server on 402 00:25:38.300 --> 00:25:42.000 the BART station. CPS and 403 00:25:41.100 --> 00:25:51.400 the application correction. She 404 00:25:50.400 --> 00:25:52.500 was looking through Virgin pulse. 405 00:25:54.800 --> 00:25:58.200 I might know if 406 00:25:57.200 --> 00:25:59.500 I quick save. 407 00:26:02.300 --> 00:26:04.700 Say, once again to save in fire. 408 00:26:07.400 --> 00:26:08.500 Define squeak. 409 00:26:19.100 --> 00:26:24.100 After deployment to IPS. Protecting 410 00:26:23.100 --> 00:26:25.300 the traffic matching. 411 00:26:28.400 --> 00:26:31.500 500 rule number four because it has 412 00:26:31.500 --> 00:26:33.400 attached Pacific. 413 00:26:35.700 --> 00:26:38.200 It looks like 414 00:26:38.200 --> 00:26:41.600 we are down here but not affected. Yeah, they 415 00:26:41.600 --> 00:26:45.400 snort he's comparing two other ideas 416 00:26:44.400 --> 00:26:47.500 on Other 417 00:26:47.500 --> 00:26:52.200 Nation. Nation Pharmacy. I will say complex and 418 00:26:51.200 --> 00:26:55.900 you will see if you will see how it's simple checkpoint, 419 00:26:54.900 --> 00:26:57.100 are on the Powerball. 420 00:26:58.300 --> 00:27:02.000 Sherry. Hathorn softer. We 421 00:27:01.300 --> 00:27:05.200 got so far. I've covered only like 30% 422 00:27:04.200 --> 00:27:07.700 of what you can do to your liver 423 00:27:07.700 --> 00:27:11.700 to improve your ideas,. Send 424 00:27:11.700 --> 00:27:14.900 me an entire Newport song dedicated 425 00:27:14.900 --> 00:27:18.000 by APS to cover 426 00:27:17.400 --> 00:27:20.300 everything, but I'm just trying to call her in 427 00:27:20.300 --> 00:27:23.100 this short time. Everything was critical to 428 00:27:23.100 --> 00:27:29.200 successfully, Implement North, Wyoming. 429 00:27:31.300 --> 00:27:34.900 Default variable 430 00:27:34.900 --> 00:27:37.600 sex. What this mean by Queen. 431 00:27:37.600 --> 00:27:40.700 I will be taking to the hot tub. 432 00:27:44.200 --> 00:27:48.400 North Korea bulbs are actually describing. 433 00:27:47.400 --> 00:27:50.400 Where is our home network 434 00:27:50.400 --> 00:27:53.000 with our work on my Ford? For example, 435 00:27:53.600 --> 00:27:58.900 I can 436 00:27:58.900 --> 00:28:01.700 enter the address. Actually, I can 437 00:28:01.700 --> 00:28:05.000 browse the objects out of the Defiance present for 438 00:28:04.400 --> 00:28:10.400 one day, 439 00:28:09.400 --> 00:28:13.300 but I can hear whatever. 440 00:28:13.300 --> 00:28:19.500 Now I 441 00:28:17.500 --> 00:28:21.200 P, S 442 00:28:21.200 --> 00:28:25.300 note that my eyes are 443 00:28:25.300 --> 00:28:27.600 trying to protect resides on this table. 444 00:28:28.700 --> 00:28:31.500 Of course, I can head out. Yeah, I forgot to 445 00:28:31.500 --> 00:28:32.900 have messed with the ministrator. 446 00:28:35.500 --> 00:28:39.600 I want to protect them external. It 447 00:28:39.600 --> 00:28:43.100 is, of course, anything but I can say external night 448 00:28:42.100 --> 00:28:44.200 for years. 449 00:28:46.100 --> 00:28:50.200 Everything, which 450 00:28:50.200 --> 00:28:52.600 is not how mad is considered external? 451 00:28:55.200 --> 00:28:58.500 Why is this important? This is 452 00:28:58.500 --> 00:29:02.300 important because if we could take 453 00:29:02.300 --> 00:29:08.400 a look at our intrusion 454 00:29:07.400 --> 00:29:09.200 signatures. 455 00:29:20.900 --> 00:29:25.000 Open our 456 00:29:24.600 --> 00:29:27.700 eyes to show 457 00:29:27.700 --> 00:29:30.700 you where these variables are mandatory part 458 00:29:30.700 --> 00:29:32.400 of snow troll definition. 459 00:29:33.800 --> 00:29:37.200 Call. Derek telling the north in 460 00:29:36.200 --> 00:29:40.700 which way to apply protection from 461 00:29:39.700 --> 00:29:42.400 inside today, outside or 462 00:29:42.400 --> 00:29:43.400 from outside to the inside. 463 00:29:44.700 --> 00:29:47.600 We also have another variable. 464 00:29:50.200 --> 00:29:53.400 DNS servers by default to 465 00:29:53.400 --> 00:29:56.900 the home. It's my entire home. Now. They can certify the 466 00:29:56.900 --> 00:30:01.200 object exit for DNS. Server. IP 467 00:29:59.200 --> 00:30:03.000 addresses are my DNS 468 00:30:02.400 --> 00:30:05.600 server, hosters my ACT Minecraft 469 00:30:05.600 --> 00:30:06.000 server. 470 00:30:08.400 --> 00:30:11.200 my friend is not the home network, 471 00:30:11.200 --> 00:30:12.300 but 472 00:30:14.600 --> 00:30:18.000 DMZ restaurant. 473 00:30:20.400 --> 00:30:23.600 Personal whenever the north room has 474 00:30:23.600 --> 00:30:26.800 says or traffic directed to the HTC servers 475 00:30:26.800 --> 00:30:30.900 the store to get some, 476 00:30:29.900 --> 00:30:33.800 this particular IP address that 477 00:30:32.800 --> 00:30:35.300 are covering their server 478 00:30:35.300 --> 00:30:44.700 attacks. The same 479 00:30:44.700 --> 00:30:48.100 turn on some another horse and this attack is HTTP related 480 00:30:47.100 --> 00:30:50.200 and this house is not defined under 481 00:30:50.200 --> 00:30:53.800 the HTTP server North Los 482 00:30:53.800 --> 00:30:57.200 trigger an hour. So it's a significant amount 483 00:30:56.200 --> 00:30:57.400 of 484 00:30:58.300 --> 00:31:01.600 But if you're not sure that you have a completely 485 00:31:01.600 --> 00:31:05.300 staff, your service is the best weave, ictp, servers 486 00:31:04.300 --> 00:31:07.300 voluble, Define at home 487 00:31:07.300 --> 00:31:10.000 that contains. 488 00:31:17.700 --> 00:31:20.200 If you are sure that every cost in your 489 00:31:20.200 --> 00:31:20.400 life. 490 00:31:31.800 --> 00:31:34.800 Yes,, I see about Bruce. 491 00:31:34.800 --> 00:31:37.400 I don't open any road show you 492 00:31:37.400 --> 00:31:38.800 the direction. 493 00:31:46.500 --> 00:31:47.100 Stop. 494 00:31:52.400 --> 00:31:58.100 Details definition. This 495 00:31:57.100 --> 00:32:00.400 is the regular expression actually a 496 00:32:00.400 --> 00:32:01.100 stream. 497 00:32:06.200 --> 00:32:10.100 Is the position where it is easy to 498 00:32:10.100 --> 00:32:14.200 write around Northridge Community with 499 00:32:13.200 --> 00:32:16.100 a powerful rules. You can go up 500 00:32:16.100 --> 00:32:20.000 there here. Please take a note of these dollar sign 501 00:32:19.700 --> 00:32:22.900 variable Caesars. North Perry about receipt. 502 00:32:22.900 --> 00:32:26.700 If the 503 00:32:25.700 --> 00:32:28.300 traffic is Flowing 504 00:32:28.300 --> 00:32:32.800 from external light, for this is 505 00:32:34.200 --> 00:32:37.600 turn on this one edition of the external networks, 506 00:32:37.600 --> 00:32:38.500 not long ago. 507 00:32:39.100 --> 00:32:42.900 And once the helmet, and 508 00:32:42.900 --> 00:32:44.200 this is the helmet. 509 00:32:46.900 --> 00:32:49.400 Only if the contents of a traffic 510 00:32:49.400 --> 00:32:52.900 contain, this particular Mission. We 511 00:32:52.900 --> 00:33:16.600 are reduced, but 512 00:33:13.600 --> 00:33:17.300 also 513 00:33:16.300 --> 00:33:20.000 keep in mind that now 514 00:33:19.500 --> 00:33:22.600 you will not be able to see if some 515 00:33:22.600 --> 00:33:25.400 Frosty, the three greatest engineering, if 516 00:33:25.400 --> 00:33:29.300 your internal part is trying to attack some external servers 517 00:33:28.300 --> 00:33:31.600 because it's North Roseville, not 518 00:33:31.600 --> 00:33:35.800 triggered. Only for 519 00:33:35.800 --> 00:33:38.600 this particular rule. Of course this particular rule. 520 00:33:38.600 --> 00:33:41.900 This particular rule actually covers 521 00:33:41.900 --> 00:33:44.500 only traffic from external Westbrook towards 522 00:33:44.500 --> 00:33:45.700 the home max volume. 523 00:33:46.900 --> 00:33:51.600 I have 524 00:33:51.600 --> 00:33:54.200 a choice to use the default fireable set of 525 00:33:54.200 --> 00:33:58.000 just modified or for the traffic matching this 526 00:33:57.000 --> 00:33:58.600 policy. 527 00:34:00.300 --> 00:34:03.300 I can apply another variable so I can have 528 00:34:03.300 --> 00:34:06.700 different viable sets for a different location than I 529 00:34:06.700 --> 00:34:09.100 have the 530 00:34:09.100 --> 00:34:12.200 internet and final. As if this is the case right now 531 00:34:12.200 --> 00:34:15.600 I cancel set, the home. Networks are 532 00:34:15.600 --> 00:34:18.300 my internal storage. Internal. My first 533 00:34:18.300 --> 00:34:21.600 cycle, say, private IP addresses and external 534 00:34:21.600 --> 00:34:24.700 structure or public IP address of. This 535 00:34:24.700 --> 00:34:27.400 is okay, snort variable test for 536 00:34:27.400 --> 00:34:30.400 the internet, communication. But if 537 00:34:30.400 --> 00:34:33.700 we have the IPS in front of 538 00:34:33.700 --> 00:34:36.400 a date, then my home you'll be 539 00:34:36.400 --> 00:34:46.900 my service on my position in 540 00:34:46.900 --> 00:34:49.600 a front of the day. I'm trying to protect data 541 00:34:49.600 --> 00:34:52.600 center services from my client from internal. 542 00:34:58.700 --> 00:35:01.800 Okay, that'll be everything for this course. 543 00:35:01.800 --> 00:35:04.500 Regarding the Cisco IP has a 544 00:35:04.500 --> 00:35:09.600 lot of these repeat. The 545 00:35:09.600 --> 00:35:14.800 best part is 546 00:35:12.800 --> 00:35:16.000 using snorting 547 00:35:15.300 --> 00:35:18.500 Gino as well. So they are using, you're 548 00:35:18.500 --> 00:35:22.800 almost the same terminology. So, you know, 549 00:35:22.800 --> 00:35:25.200 how to configure the PSU, know 550 00:35:25.200 --> 00:35:28.400 how to configure extra, you know, if you want, then understand this 551 00:35:28.400 --> 00:35:31.400 note, computer, Asian and then you know how to apply 552 00:35:31.400 --> 00:35:39.200 for the apartment. 553 00:35:38.200 --> 00:35:41.100 Thank you for what?