Recent Blog Posts
-
Enabling or Disabling an Intrusion Rule – Cisco Network Analysis and Intrusion Policies
•
Enabling or Disabling an Intrusion Rule Secure Firewall is equipped with thousands of intrusion rules, but not all of them are enabled at the same time. You learned about it in the “System-Provided Base Policies” section. To enable or disable an additional Snort rule in an intrusion policy, edit the…
-
Note – Cisco Network Analysis and Intrusion Policies
•
Note Although this book primarily uses Secure Firewall software version 7.0 in its screenshots, only Figure 15-24 uses version 7.1 to capture the screenshot. We made this exception because the rule recommendations feature on the Snort 3 version of the intrusion policy is introduced in software version 7.1. To understand…
-
Configuring an Intrusion Policy – Cisco Network Analysis and Intrusion Policies
•
Configuring an Intrusion Policy Intrusion policy configuration is the key part of an IPS deployment. This is where you select an intrusion ruleset and define the rule actions. You can start with one of the system-provided base policies and build your own ruleset on top of it. An intrusion policy…
-
Configuring a Network Analysis Policy – Cisco Network Analysis and Intrusion Policies
•
Configuring a Network Analysis Policy Let’s begin the configurations. Here are the steps to create a new network analysis policy from scratch: Step 1. Navigate to Policies > Access Control > Intrusion, and then select the Network Analysis Policies tab. Step 2. Click the Create Policy button. The Create Network…
-
Best Practices for Intrusion Policy Deployment – Cisco Network Analysis and Intrusion Policies
•
Best Practices for Intrusion Policy Deployment Consider the following best practices when you deploy Secure Firewall to protect your network from intrusion attempts. They can help you to achieve an optimal experience. The configuration details of these items are described in later sections of this chapter. If you want…
-
System-Provided Base Policies – Cisco Network Analysis and Intrusion Policies
•
System-Provided Base Policies To help you with initial deployment, Secure Firewall software comes with several preconfigured network analysis and intrusion policies. You can deploy one of them directly, or use one as a baseline for your custom intrusion policy: Balanced Security and Connectivity: This base policy is the best…
-
Connecting to a Masqueraded Destination (Destination NAT for Inbound Connection) – Cisco Network Address Translation (NAT)
•
Connecting to a Masqueraded Destination (Destination NAT for Inbound Connection) When external hosts access any services of your company, they should access through the public IP address of your organization. Any internal addressing scheme must be invisible to the external users. In this section, you learn how to connect…
-
Verifying the Operation: Outside to Inside
•
Verifying the Operation: Outside to Inside The NAT rule you created earlier evaluates the forward traffic—the traffic that originates from INSIDE_INTERFACE and is destined for OUTSIDE_INTERFACE. However, any traffic in the reverse direction does not match this rule. You can verify this by capturing SSH traffic on OUTSIDE_INTERFACE and by…
-
“Do I Know This Already?” Quiz – Cisco Network Address Translation (NAT)
•
“Do I Know This Already?” Quiz The “Do I Know This Already?” quiz enables you to assess whether you should read this entire chapter thoroughly or jump to the “Exam Preparation Tasks” section. If you are in doubt about your answers to these questions or your own assessment of your…