WEBVTT 00:00:01.300 --> 00:00:02.029 [Autogenerated] Alright. 00:00:02.210 --> 00:00:05.640 Let's hop into the lab and explore this solution a bit more. 00:00:06.180 --> 00:00:09.880 We'll take a look at the configuration capabilities and the alerting 00:00:09.880 --> 00:00:12.540 and investigative capabilities of snorting this one. 00:00:12.900 --> 00:00:16.030 Let's get it going alright. 00:00:16.040 --> 00:00:19.370 And here we are in the lab, in this one like we mentioned, 00:00:19.370 --> 00:00:23.850 we're gonna be going over Cisco secure firewall management center or what 00:00:23.850 --> 00:00:26.390 used to be known as the Firepower Management Center. 00:00:27.100 --> 00:00:30.620 And in this one we're gonna be talking about how snort integrates with it. 00:00:30.630 --> 00:00:35.290 The Cisco secure firewall system has snort built into it for the next 00:00:35.290 --> 00:00:38.900 generation firewalls that they have with the current versions you can 00:00:38.900 --> 00:00:41.230 use either snort to or snort three. 00:00:41.810 --> 00:00:45.940 So let's explore the policies that we can have with this and 00:00:45.940 --> 00:00:47.840 see how snore interacts with the system. 00:00:48.510 --> 00:00:49.820 As you saw on the slides, 00:00:49.830 --> 00:00:53.580 the snort workflow is included in the LENA workflow when we're 00:00:53.580 --> 00:00:57.030 talking about how a packet travels through the system or how a 00:00:57.030 --> 00:00:58.920 connection goes through the system. 00:00:59.440 --> 00:01:02.910 So when we're using this, not only do we have to define R. 00:01:02.920 --> 00:01:03.080 I. 00:01:03.080 --> 00:01:03.310 P. 00:01:03.310 --> 00:01:05.760 S policy, which we'll do right here, 00:01:05.770 --> 00:01:10.070 but we'll also have to tie it to an access control policy or a 00:01:10.070 --> 00:01:15.440 typical firewall policy and either tie inspection capabilities 00:01:15.440 --> 00:01:18.020 to each rule or to the default rule. 00:01:18.030 --> 00:01:20.300 So let's go check out the snort three version of 00:01:20.300 --> 00:01:22.580 this policy and upon clicking it, 00:01:22.580 --> 00:01:26.350 as you can see there's a very nice GUI that breaks all of the rules 00:01:26.350 --> 00:01:31.060 down into categories and groups and really helps us see the 00:01:31.060 --> 00:01:34.210 information better as opposed to trying to look at this in the 00:01:34.210 --> 00:01:35.990 command line interface for example. 00:01:36.460 --> 00:01:40.310 Now we have our based policy here that I'm using is 00:01:40.310 --> 00:01:41.990 balance security and connectivity. 00:01:42.000 --> 00:01:45.300 We have the amount of rules that are disabled up here. 00:01:45.300 --> 00:01:47.370 How many are said to alert and block? 00:01:47.380 --> 00:01:50.630 And this is just a standard policy based off this 00:01:50.630 --> 00:01:52.510 balance security and connectivity one. 00:01:53.180 --> 00:01:57.130 In reality we shouldn't have this many disabled rules 00:01:57.140 --> 00:01:59.620 but for lab purposes it's okay. 00:01:59.650 --> 00:02:02.880 We can also change the mode from prevention to detection if we 00:02:02.880 --> 00:02:06.290 wanted to hear clicking through these tabs. 00:02:06.300 --> 00:02:09.720 What's really cool about this is we can see what rules 00:02:09.720 --> 00:02:12.220 were included in that base policy, 00:02:12.220 --> 00:02:15.010 that balance security and connectivity based policy. 00:02:15.660 --> 00:02:20.420 And then we can go over and actually create overrides for different groups. 00:02:20.470 --> 00:02:23.150 We can see the recommendations as well. 00:02:24.160 --> 00:02:28.220 And what this does is it runs an analysis based on the traffic that 00:02:28.220 --> 00:02:33.570 the firewall has seen and creates rural recommendations specific to 00:02:33.570 --> 00:02:35.320 the protected networks that you select. 00:02:36.000 --> 00:02:40.410 We can override specific rules individually as well which is really cool. 00:02:41.050 --> 00:02:42.640 And then we have that summary tab. 00:02:43.240 --> 00:02:46.840 What I really like about this is we can search easily in 00:02:46.840 --> 00:02:50.000 here for specific rules for example icmp. 00:02:50.000 --> 00:02:53.680 If I wanted to pull up all the rules that contained icmp we could 00:02:53.680 --> 00:02:55.990 just type that into the search field and here it is. 00:02:56.490 --> 00:03:00.340 It looks like there's about 226 out of the 48,000 rules here. 00:03:01.310 --> 00:03:04.790 We can also modify the rule action straight from this 00:03:04.790 --> 00:03:09.240 dropdown menu so we can customize these rules in an easy way 00:03:09.250 --> 00:03:11.360 and tell them to reject or disable. 00:03:11.360 --> 00:03:14.240 Drop rewrite alert or block. 00:03:14.950 --> 00:03:18.530 We can comment on the rules, copy them and create our own. 00:03:18.540 --> 00:03:23.850 So having snort built into this firewall management center and the 00:03:23.850 --> 00:03:29.070 corresponding sensors or firewalls that it deploys to is really 00:03:29.070 --> 00:03:34.560 helpful because it gives us a nice GUI view of snort in general and it 00:03:34.560 --> 00:03:38.630 allows us to control it in a very granular way that makes it easy for 00:03:38.630 --> 00:03:40.710 administrators to configure. 00:03:41.900 --> 00:03:47.190 So let's check this out real quick and let's turn on a quick iCmp rule. 00:03:47.200 --> 00:03:50.510 Let's see if we can narrow it down further by searching for ping as well. 00:03:52.290 --> 00:03:56.610 All right now to test out the snort capabilities in here and 00:03:56.610 --> 00:04:01.790 how the dashboards and everything work, let's turn on this iCmp ping rule, 00:04:01.800 --> 00:04:03.080 we'll just set it to alert. 00:04:03.090 --> 00:04:08.340 So this is gonna go into one of my rule overrides and it's going to give 00:04:08.340 --> 00:04:11.690 us an alert on our dashboard every time pings detected. 00:04:11.700 --> 00:04:13.350 But remember what we said, 00:04:13.350 --> 00:04:18.579 we have to go tie this to an actual firewall policy or an access control policy. 00:04:18.589 --> 00:04:22.400 So let's do that real quick and then we'll push it to the firewall and test it. 00:04:22.970 --> 00:04:26.350 I'm gonna edit my access control policy and as you can 00:04:26.350 --> 00:04:28.350 see I have a whole bunch of rules here. 00:04:28.360 --> 00:04:31.490 So let's do Lobo ping for the name. 00:04:32.700 --> 00:04:34.710 We're going to have the action allow. 00:04:34.720 --> 00:04:38.090 So that means the firewall will allow it through but it 00:04:38.090 --> 00:04:40.040 will still make sure it's inspected. 00:04:40.040 --> 00:04:45.940 If we have inspection turned on For the networks will go any IPV4 for 00:04:45.940 --> 00:04:51.130 the source and then we'll do the globomantics D. 00:04:51.130 --> 00:04:51.360 C. 00:04:51.360 --> 00:04:53.400 Specifically for the destination. 00:04:54.340 --> 00:04:57.820 Now for the ports for the applications, 00:04:57.820 --> 00:05:02.890 I mean not the ports will select iCMP for the selected application. 00:05:02.900 --> 00:05:05.290 So anything that's ICMP related, 00:05:05.300 --> 00:05:08.770 going from anywhere to the Globomantics Domain 00:05:08.770 --> 00:05:12.490 controller will be caught by this rule. 00:05:12.500 --> 00:05:15.350 Now we have to turn the inspection on so let's turn our intrusion 00:05:15.350 --> 00:05:19.690 policy to that global intrusion policy and then let's make the 00:05:19.690 --> 00:05:23.130 logging occur at the end of the connection and we'll just log it 00:05:23.130 --> 00:05:24.380 to the firewall management. 00:05:24.380 --> 00:05:27.620 center all-right ad added that rule. 00:05:27.630 --> 00:05:30.980 So now we have inspection capabilities and logging turned on for that rule 00:05:30.980 --> 00:05:35.990 specifically and let's hit save and now I'm going to deploy this to the 00:05:35.990 --> 00:05:39.850 firewalls so I can understand the new policies and send the alerts up to the 00:05:39.850 --> 00:05:44.450 firewall management center now while this is deploying I fast forwarded to 00:05:44.450 --> 00:05:47.880 the video so it might look super quick but it actually took a couple minutes 00:05:47.880 --> 00:05:48.790 for it to deploy. 00:05:49.740 --> 00:05:54.110 Alright, now that that's deployed let's go ahead and test this out, 00:05:54.120 --> 00:05:59.470 I'm gonna hop over to my dev box real quick and just paying my Globomantics 00:05:59.470 --> 00:06:04.440 domain controller and just a couple packages should be enough. 00:06:04.450 --> 00:06:07.130 Alright, so the ping worked. 00:06:07.140 --> 00:06:10.810 Now let's hop back over to our firewall management center and look at 00:06:10.810 --> 00:06:13.460 the data that it gives us with this snort integration. 00:06:14.130 --> 00:06:20.200 So I'm gonna navigate over to the overview and dashboards tab and in this 00:06:20.200 --> 00:06:23.530 summary dashboard it gives us a lot of information about the application 00:06:23.530 --> 00:06:26.410 scene and the clients and the operating system scene. 00:06:26.420 --> 00:06:28.240 But let's look at the intrusion events. 00:06:28.240 --> 00:06:30.370 Since we're talking about snort specifically, 00:06:31.130 --> 00:06:34.290 as you can see we don't have any top attacker data but we do 00:06:34.290 --> 00:06:36.540 have some intrusion events in the last hour. 00:06:36.790 --> 00:06:40.020 If we go up to analysis and intrusion events, 00:06:40.020 --> 00:06:44.000 let's go look and see what they were and check this out. 00:06:44.010 --> 00:06:46.440 We have our protocol iCmp, 00:06:46.440 --> 00:06:50.440 ping intrusion event that got flagged here as an alert, 00:06:50.450 --> 00:06:53.620 we can click on it to bring up more information about it, 00:06:53.630 --> 00:06:58.090 we could see when it occurred, we could see what the source IP was, 00:06:58.100 --> 00:07:03.380 what the destination IP was, what the ports was the ICMP code so on and so forth. 00:07:03.380 --> 00:07:03.630 Right, 00:07:03.630 --> 00:07:07.120 because snort was able to actually inspect this packet and 00:07:07.120 --> 00:07:08.890 gather all the information about it. 00:07:09.120 --> 00:07:13.480 And what's really cool is this system automatically assigns impact flags, 00:07:13.490 --> 00:07:18.110 to allow stock analysts and security professionals be able to rank and 00:07:18.110 --> 00:07:23.020 prioritize any sort of intrusion events in here a little bit better if 00:07:23.020 --> 00:07:27.130 we go back over to those dashboards, you can see that that security event, 00:07:27.130 --> 00:07:31.600 the intrusion event that we had for ICMP was rated as an impact event three. 00:07:31.610 --> 00:07:33.300 Well looking here, 00:07:33.310 --> 00:07:36.590 we have shown that it was an impact event three here that 00:07:36.590 --> 00:07:39.960 was flagged and what's really cool is we could do some 00:07:39.970 --> 00:07:41.990 really awesome analysis with this, 00:07:41.990 --> 00:07:45.990 we can actually download the packets and see what the packets look like. 00:07:46.690 --> 00:07:51.910 So if I check that box and I hit download packets, it spits out a p cap for me. 00:07:53.580 --> 00:07:55.640 All right, and now that that's done downloading, 00:07:55.650 --> 00:07:59.270 let's just open it up in wireshark and as you can see, 00:07:59.270 --> 00:08:05.840 we can see that icmp packet going from my 10101 box to this domain controller. 00:08:06.600 --> 00:08:09.510 So not only does the Cisco secure firewall management 00:08:09.510 --> 00:08:12.470 center and the Cisco secure firewall itself allow us to 00:08:12.470 --> 00:08:15.080 use snort in an integrated manner. 00:08:15.090 --> 00:08:19.120 The system was actually built with snorting mind and 00:08:19.130 --> 00:08:21.600 allows us to not only inspect, 00:08:21.610 --> 00:08:25.750 detect and prevent intrusions with the snort rules, 00:08:25.760 --> 00:08:28.180 but we can more easily customize them, 00:08:28.190 --> 00:08:32.890 conduct an analysis on the events that occur and even integrated with 00:08:32.890 --> 00:08:36.890 other platforms like sims and source or something along the lines of Cisco 00:08:36.890 --> 00:08:41.720 secure X to allow for better automation and orchestration and that single 00:08:41.720 --> 00:08:43.620 pane of glass view for everything. 00:08:43.630 --> 00:08:46.230 So it's really cool that this is all packaged up in 00:08:46.230 --> 00:08:49.500 one box and that's a wrap on, 00:08:49.500 --> 00:08:52.800 seeing how you can visualize and optimize snort and the 00:08:52.800 --> 00:08:55.290 snort data using a few GUI tools, 00:08:55.390 --> 00:08:58.430 we talked about the uses of snort in conjunction with 00:08:58.430 --> 00:09:00.820 the Elastic Stack and how it very, 00:09:00.820 --> 00:09:03.880 very tightly integrates with Cisco secure firewall. 00:09:04.460 --> 00:09:05.610 In the next module, 00:09:05.720 --> 00:09:09.990 you're going to explore the pre processors and how to use them appropriately. 00:09:10.130 --> 00:09:11.410 Join me there.