WEBVTT

00:00:00.930 --> 00:00:03.110
[Autogenerated] Let's get started by talking about how to

00:00:03.120 --> 00:00:05.810
integrate snore with the open source firewall,

00:00:05.820 --> 00:00:06.790
PF sense.

00:00:07.540 --> 00:00:10.820
This integration is done via the PF sense package

00:00:10.820 --> 00:00:14.170
manager and it's super easy to install,

00:00:14.180 --> 00:00:18.040
I'll show you how it works in the next clip when

00:00:18.050 --> 00:00:23.890
integrating Snort with PF sense, there's a few features that stand out 1st.

00:00:24.360 --> 00:00:28.880
You have a gui to manage everything in the rules,

00:00:28.890 --> 00:00:33.230
the interface configurations and the alerting behavior can all be

00:00:33.230 --> 00:00:38.700
controlled via a GUI You can use the alerts that snort generates to

00:00:38.700 --> 00:00:42.290
explore more information like looking up the I.

00:00:42.290 --> 00:00:42.670
P.

00:00:42.670 --> 00:00:44.640
S or fully qualified domain names,

00:00:45.460 --> 00:00:49.950
you can easily swap which rules that you want and turn on and off or

00:00:49.950 --> 00:00:56.260
modified rules with a few clicks and managing the IP list is super

00:00:56.260 --> 00:01:03.660
easy with this installation of Snort, you can also support in line I PS mode,

00:01:03.930 --> 00:01:07.480
this means that you can actively block the bad actors and

00:01:07.480 --> 00:01:09.460
help automate some of the isolation.

00:01:10.090 --> 00:01:13.450
Alright, let's hop into the lab and check it out.

00:01:15.130 --> 00:01:19.900
Alright and here we are in our lab for this first demo of the course.

00:01:19.910 --> 00:01:23.480
And what we're gonna do is we're gonna talk about how snore integrates

00:01:23.480 --> 00:01:28.230
with PF sense and the free firewall that we've been talking about that

00:01:28.230 --> 00:01:33.210
Snort easily integrates with this integration gives you some really nice

00:01:33.210 --> 00:01:37.690
GUI capabilities and we'll expand on some GUI integrations with Snore

00:01:37.700 --> 00:01:39.320
later on in the course as well.

00:01:39.330 --> 00:01:44.160
When we talk about Cisco firepower and a couple other technologies but this is

00:01:44.160 --> 00:01:48.220
cool because it's nice and open source so you can put it in your lab without

00:01:48.220 --> 00:01:52.340
any licensing and you can easily go in install,

00:01:52.340 --> 00:01:54.350
store and get it up and running.

00:01:54.930 --> 00:01:58.530
So what we're gonna do is we're gonna install snort real quick and

00:01:58.530 --> 00:02:01.880
then kind of show you around the different configuration items and how

00:02:01.880 --> 00:02:04.160
it actually integrates with the firewall.

00:02:05.040 --> 00:02:07.860
So the first thing I'm gonna do is go to the package manager.

00:02:07.870 --> 00:02:12.140
This is where we download the additional modules in Pf sense and

00:02:12.140 --> 00:02:14.480
if you've never touched this firewall before,

00:02:14.490 --> 00:02:17.860
you need a refresher on it or you need to understand how to

00:02:17.860 --> 00:02:20.700
build it in your particular environment or lab.

00:02:20.710 --> 00:02:24.100
Pluralsight has a couple of courses available to help you with this.

00:02:24.110 --> 00:02:25.560
So you can go check them out.

00:02:25.570 --> 00:02:29.490
But the package manager here is what allows us to install additional

00:02:29.490 --> 00:02:33.800
capabilities and we have different packages available.

00:02:33.810 --> 00:02:37.710
We have ones for net flow, we have ones for I.

00:02:37.710 --> 00:02:37.960
P.

00:02:37.960 --> 00:02:39.010
S capabilities.

00:02:39.010 --> 00:02:39.940
We have bind.

00:02:39.950 --> 00:02:43.620
Uh so there's a lot of different capabilities that we have in here.

00:02:43.630 --> 00:02:45.570
If we scroll down to the S.

00:02:45.570 --> 00:02:47.890
Section or you can just search for it.

00:02:47.890 --> 00:02:49.830
We should see snort.

00:02:49.840 --> 00:02:50.560
There we go.

00:02:51.870 --> 00:02:52.550
Alright.

00:02:52.800 --> 00:02:57.540
And so all we have to do is click install and confirm it and

00:02:57.540 --> 00:03:01.380
we'll let pf sense do its thing install the package and this

00:03:01.380 --> 00:03:02.520
will take a couple of minutes.

00:03:02.530 --> 00:03:06.340
I spent the video up a little bit, but now it's installed, ready to go.

00:03:06.350 --> 00:03:07.750
So where do we go from here.

00:03:08.270 --> 00:03:11.440
Well when we're setting up snort with the pf sense firewall,

00:03:11.500 --> 00:03:16.290
we need to start configuring it now to do so we need to go

00:03:16.290 --> 00:03:20.210
over to the services menu and as you can see,

00:03:20.210 --> 00:03:22.680
we have this new snort option here.

00:03:22.690 --> 00:03:24.040
So let's click that.

00:03:25.100 --> 00:03:28.610
And now we have our snort configuration menus here.

00:03:29.270 --> 00:03:31.960
There's only one interface shown here, but that's okay.

00:03:31.960 --> 00:03:33.600
We'll come back to these in a second.

00:03:33.610 --> 00:03:37.220
The first thing we're going to do is go over to the global settings.

00:03:37.890 --> 00:03:41.950
Now this is where we can add our rule sets so we can use

00:03:41.950 --> 00:03:44.780
the snort subscriber rule sets by Talos.

00:03:44.800 --> 00:03:48.860
We can sign up for the free registered user rules.

00:03:48.870 --> 00:03:51.960
So we have a lot of the same capabilities that we have with the native

00:03:51.960 --> 00:03:55.730
snort instance in Linux or any other operating system.

00:03:55.740 --> 00:03:59.480
We can also enable the download of the community rule sets here,

00:03:59.490 --> 00:04:01.970
emerging threats and so on and so forth.

00:04:01.980 --> 00:04:04.920
Here's also where we would configure our rule update

00:04:04.920 --> 00:04:09.730
settings and just the general settings for blocking hosts

00:04:09.730 --> 00:04:11.740
and how the behavior around that is.

00:04:12.410 --> 00:04:15.730
So the next tab I want to go to is the updates and when we

00:04:15.730 --> 00:04:19.720
installed snore it updated the rule set automatically for us

00:04:19.720 --> 00:04:21.779
that came standard with the configuration.

00:04:21.790 --> 00:04:26.150
So we should be good on here unless we want to download the

00:04:26.150 --> 00:04:29.080
subscriber rule sets or any of the other ones.

00:04:29.090 --> 00:04:31.100
We also have the alerts tab,

00:04:31.110 --> 00:04:34.840
which is where we would see all of the alerts if we had an interface

00:04:34.840 --> 00:04:37.760
enabled to actually process the snort traffic.

00:04:38.050 --> 00:04:39.720
Same with the blocked tab.

00:04:39.730 --> 00:04:42.640
This is where we would go view those hosts that were blocked by snort.

00:04:43.950 --> 00:04:46.330
We can suppress different rules here as well.

00:04:46.610 --> 00:04:51.350
We can create our IP lists, manage the rule states as well.

00:04:52.360 --> 00:04:55.210
And then of course we have our log settings and our sync

00:04:55.210 --> 00:04:56.530
settings and everything like that.

00:04:57.400 --> 00:05:00.440
Now on an interface, if we wanted to enable snore,

00:05:00.450 --> 00:05:02.910
we could either add another interface that we have.

00:05:02.910 --> 00:05:03.680
For example,

00:05:03.690 --> 00:05:08.520
here we have our management interface and this is where we would set

00:05:08.520 --> 00:05:11.340
up the settings for how we send alerts for it,

00:05:12.030 --> 00:05:16.380
how we block offenders or if we will block offenders or are we going to

00:05:16.380 --> 00:05:20.860
just use this as an ideas and then also we can configure some detection

00:05:20.860 --> 00:05:23.410
settings define our home net in our external net,

00:05:23.410 --> 00:05:28.790
which is typical in snort installations and customize Either options

00:05:28.790 --> 00:05:32.160
for passthroughs or alert suppression and filtering.

00:05:32.710 --> 00:05:35.540
And now if you wanted to enable this interface,

00:05:35.540 --> 00:05:37.270
just as is we can hit save,

00:05:38.080 --> 00:05:43.470
let's enable the log settings real quick and packet capture now that it's saved.

00:05:43.480 --> 00:05:45.670
We can go over to the categories too.

00:05:45.690 --> 00:05:51.170
So this is where we would select which categories of rule sets or of rules,

00:05:51.230 --> 00:05:53.890
we would want to apply to this interface.

00:05:53.990 --> 00:05:56.790
So would I apply just the community rules.

00:05:56.790 --> 00:06:00.220
Do I want to apply any of the emerging threat rules for now.

00:06:00.220 --> 00:06:04.900
Let's just enable the community rules after hitting save,

00:06:04.910 --> 00:06:12.130
we can go look at him and it shows a nice easy to read table of each rule

00:06:12.130 --> 00:06:16.350
that's in the community rule set and it tells us if it's enabled or disabled

00:06:16.350 --> 00:06:18.910
and then we can go in and modify those behaviors.

00:06:18.910 --> 00:06:20.180
We can enable them all,

00:06:20.190 --> 00:06:23.590
we can disable them all or we can go in one by one

00:06:23.590 --> 00:06:25.710
and either enable or disable them.

00:06:26.420 --> 00:06:29.020
And then also we can control the variables here.

00:06:29.020 --> 00:06:33.140
So we can define our home net, r http servers, so on and so forth.

00:06:33.140 --> 00:06:36.820
To give snort a little bit better context around the traffic that it sees.

00:06:38.270 --> 00:06:40.360
We can control the pre processors here,

00:06:40.360 --> 00:06:43.650
which we will definitely be talking about later on in the course.

00:06:43.660 --> 00:06:47.830
But this is a great way to explore some of the pre processors that are

00:06:47.830 --> 00:06:52.960
available and then we can control the IP reputation list and everything

00:06:52.960 --> 00:06:54.950
like that for this particular interface.

00:06:54.970 --> 00:06:58.440
This is awesome because it gives us such granular control

00:06:58.450 --> 00:07:01.840
over the capabilities of snort with each individual

00:07:01.850 --> 00:07:04.200
interface on the Pf sense firewall.

00:07:04.210 --> 00:07:07.650
So this integration is really cool and it's very powerful

00:07:07.660 --> 00:07:09.860
and then after we configure the interface,

00:07:09.870 --> 00:07:13.770
all we have to do is select start and snort starting for us