[Autogenerated] Alright.
Let's hop into the lab and explore this solution a bit more.
We'll take a look at the configuration capabilities and the alerting
and investigative capabilities of snorting this one.
Let's get it going alright.
And here we are in the lab, in this one like we mentioned,
we're gonna be going over Cisco secure firewall management center or what
used to be known as the Firepower Management Center.
And in this one we're gonna be talking about how snort integrates with it.
The Cisco secure firewall system has snort built into it for the next
generation firewalls that they have with the current versions you can
use either snort to or snort three.
So let's explore the policies that we can have with this and
see how snore interacts with the system.
As you saw on the slides,
the snort workflow is included in the LENA workflow when we're
talking about how a packet travels through the system or how a
connection goes through the system.
So when we're using this, not only do we have to define R.
I.
P.
S policy, which we'll do right here,
but we'll also have to tie it to an access control policy or a
typical firewall policy and either tie inspection capabilities
to each rule or to the default rule.
So let's go check out the snort three version of
this policy and upon clicking it,
as you can see there's a very nice GUI that breaks all of the rules
down into categories and groups and really helps us see the
information better as opposed to trying to look at this in the
command line interface for example.
Now we have our based policy here that I'm using is
balance security and connectivity.
We have the amount of rules that are disabled up here.
How many are said to alert and block?
And this is just a standard policy based off this
balance security and connectivity one.
In reality we shouldn't have this many disabled rules
but for lab purposes it's okay.
We can also change the mode from prevention to detection if we
wanted to hear clicking through these tabs.
What's really cool about this is we can see what rules
were included in that base policy,
that balance security and connectivity based policy.
And then we can go over and actually create overrides for different groups.
We can see the recommendations as well.
And what this does is it runs an analysis based on the traffic that
the firewall has seen and creates rural recommendations specific to
the protected networks that you select.
We can override specific rules individually as well which is really cool.
And then we have that summary tab.
What I really like about this is we can search easily in
here for specific rules for example icmp.
If I wanted to pull up all the rules that contained icmp we could
just type that into the search field and here it is.
It looks like there's about 226 out of the 48,000 rules here.
We can also modify the rule action straight from this
dropdown menu so we can customize these rules in an easy way
and tell them to reject or disable.
Drop rewrite alert or block.
We can comment on the rules, copy them and create our own.
So having snort built into this firewall management center and the
corresponding sensors or firewalls that it deploys to is really
helpful because it gives us a nice GUI view of snort in general and it
allows us to control it in a very granular way that makes it easy for
administrators to configure.
So let's check this out real quick and let's turn on a quick iCmp rule.
Let's see if we can narrow it down further by searching for ping as well.
All right now to test out the snort capabilities in here and
how the dashboards and everything work, let's turn on this iCmp ping rule,
we'll just set it to alert.
So this is gonna go into one of my rule overrides and it's going to give
us an alert on our dashboard every time pings detected.
But remember what we said,
we have to go tie this to an actual firewall policy or an access control policy.
So let's do that real quick and then we'll push it to the firewall and test it.
I'm gonna edit my access control policy and as you can
see I have a whole bunch of rules here.
So let's do Lobo ping for the name.
We're going to have the action allow.
So that means the firewall will allow it through but it
will still make sure it's inspected.
If we have inspection turned on For the networks will go any IPV4 for
the source and then we'll do the globomantics D.
C.
Specifically for the destination.
Now for the ports for the applications,
I mean not the ports will select iCMP for the selected application.
So anything that's ICMP related,
going from anywhere to the Globomantics Domain
controller will be caught by this rule.
Now we have to turn the inspection on so let's turn our intrusion
policy to that global intrusion policy and then let's make the
logging occur at the end of the connection and we'll just log it
to the firewall management.
center all-right ad added that rule.
So now we have inspection capabilities and logging turned on for that rule
specifically and let's hit save and now I'm going to deploy this to the
firewalls so I can understand the new policies and send the alerts up to the
firewall management center now while this is deploying I fast forwarded to
the video so it might look super quick but it actually took a couple minutes
for it to deploy.
Alright, now that that's deployed let's go ahead and test this out,
I'm gonna hop over to my dev box real quick and just paying my Globomantics
domain controller and just a couple packages should be enough.
Alright, so the ping worked.
Now let's hop back over to our firewall management center and look at
the data that it gives us with this snort integration.
So I'm gonna navigate over to the overview and dashboards tab and in this
summary dashboard it gives us a lot of information about the application
scene and the clients and the operating system scene.
But let's look at the intrusion events.
Since we're talking about snort specifically,
as you can see we don't have any top attacker data but we do
have some intrusion events in the last hour.
If we go up to analysis and intrusion events,
let's go look and see what they were and check this out.
We have our protocol iCmp,
ping intrusion event that got flagged here as an alert,
we can click on it to bring up more information about it,
we could see when it occurred, we could see what the source IP was,
what the destination IP was, what the ports was the ICMP code so on and so forth.
Right,
because snort was able to actually inspect this packet and
gather all the information about it.
And what's really cool is this system automatically assigns impact flags,
to allow stock analysts and security professionals be able to rank and
prioritize any sort of intrusion events in here a little bit better if
we go back over to those dashboards, you can see that that security event,
the intrusion event that we had for ICMP was rated as an impact event three.
Well looking here,
we have shown that it was an impact event three here that
was flagged and what's really cool is we could do some
really awesome analysis with this,
we can actually download the packets and see what the packets look like.
So if I check that box and I hit download packets, it spits out a p cap for me.
All right, and now that that's done downloading,
let's just open it up in wireshark and as you can see,
we can see that icmp packet going from my 10101 box to this domain controller.
So not only does the Cisco secure firewall management
center and the Cisco secure firewall itself allow us to
use snort in an integrated manner.
The system was actually built with snorting mind and
allows us to not only inspect,
detect and prevent intrusions with the snort rules,
but we can more easily customize them,
conduct an analysis on the events that occur and even integrated with
other platforms like sims and source or something along the lines of Cisco
secure X to allow for better automation and orchestration and that single
pane of glass view for everything.
So it's really cool that this is all packaged up in
one box and that's a wrap on,
seeing how you can visualize and optimize snort and the
snort data using a few GUI tools,
we talked about the uses of snort in conjunction with
the Elastic Stack and how it very,
very tightly integrates with Cisco secure firewall.
In the next module,
you're going to explore the pre processors and how to use them appropriately.
Join me there.