This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Newbie IPS question

I have the IPS default policy to drop silently and all the attack patterns are set to drop. However, the following attack was not dropped as I would expect.I am doing something wrong?

192.168.1.60 is the Wan interface of ASG

2009:03:19-23:08:06 Astaro barnyard[4095]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="ICMP Destination Unreachable Communication Administratively Prohibited" group="420" srcip="91.18.54.6" dstip="192.168.1.60" proto="1" srcport="3" dstport="13" sid="485" class="Misc activity" priority="3" generator="1" msgid="0"
2009:03:19-23:12:57 Astaro barnyard[4095]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="ICMP Destination Unreachable Communication Administratively Prohibited" group="420" srcip="91.18.54.6" dstip="192.168.1.60" proto="1" srcport="3" dstport="13" sid="485" class="Misc activity" priority="3" generator="1" msgid="0"

Intrusion Protection Alert

An intrusion has been detected. The packet has *not* been dropped.
If you want to block packets like this one in the future,
set the corresponding intrusion protection rule to "drop" in WebAdmin.
Be careful not to block legitimate traffic caused by false alerts though.

Details about the intrusion alert:

Message........: ICMP Destination Unreachable Communication Administratively Prohibited
Details........: http://www.snort.org/pub-bin/sigs.cgi?sid=485
Time...........: 2009:03:19-23:12:57
Packet dropped.: no
Priority.......: 3 (low)
Classification.: Misc activity
IP protocol....: 1 (ICMP)

Source IP address: 91.18.54.6 (p5B123606.dip0.t-ipconnect.de)
- http://www.dnsstuff.com/tools/ptr.ch?ip=91.18.54.6
- http://www.ripe.net/perl/whois?query=91.18.54.6
- http://ws.arin.net/cgi-bin/whois.pl?queryinput=91.18.54.6
- http://cgi.apnic.net/apnic-bin/whois.pl?search=91.18.54.6
Source port: 3
Destination IP address: 192.168.1.60 (Astaro)
- http://www.dnsstuff.com/tools/ptr.ch?ip=192.168.1.60
- http://www.ripe.net/perl/whois?query=192.168.1.60
- http://ws.arin.net/cgi-bin/whois.pl?queryinput=192.168.1.60
- http://cgi.apnic.net/apnic-bin/whois.pl?search=192.168.1.60
Destination port: 13

Can someone confirm that the following is the way to solve the issue:

network security>>Intrusion Protection>>advanced and add the relevant rules id (2103,2102,3264,3335) with drop action

This thread was automatically locked due to age.

Parents

0 Jim Tagert over 16 years ago

I have the IPS default policy to drop silently and all the attack patterns are set to drop. However, the following attack was not dropped as I would expect.I am doing something wrong?

Can someone confirm that the following is the way to solve the issue:

network security>>Intrusion Protection>>advanced and add the relevant rules id (2103,2102,3264,3335) with drop action

Yep, create a rule and set it to drop and notify and NOT disable. Let the FW/ASG handle pings, icmp, and tracert so you do not break the internet.

Note: Not all ICMP traffic is good.
c:\discoverHosts (ip range) and away we go. Your unblocked ICMP lets me map your network.

SANS Institute - Intrusion Detection FAQ: I am seeing odd ICMP traffic, what could this mean?

If the packet were normal, the rule would not have activated. That's why we have IPS.

Jim
Cancel
Vote Up 0 Vote Down

Cancel
0 wingman over 16 years ago in reply to Jim Tagert

Yep, create a rule and set it to drop and notify and NOT disable. Let the FW/ASG handle pings, icmp, and tracert so you do not break the internet.

Note: Not all ICMP traffic is good.
c:\discoverHosts (ip range) and away we go. Your unblocked ICMP lets me map your network.

SANS Institute - Intrusion Detection FAQ: I am seeing odd ICMP traffic, what could this mean?

If the packet were normal, the rule would not have activated. That's why we have IPS.

Jim

HI Jim

I 've created the relevant rule.However, according to astaro blog the way to block a certain attack is by setting the relevantentry to drop. (Exactly what I did on my first post)

Why should I create the rule again on the advanced tab to block the specific attack?
Cancel
Vote Up 0 Vote Down

Cancel

0 wingman over 16 years ago in reply to wingman

same issue with another rule

2009:04:09-19:19:56 Astaro barnyard[6010]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited" group="420" srcip="195.74.241.211" dstip="192.168.2.40" proto="1" srcport="3" dstport="10" sid="486" class="Misc activity" priority="3"  generator="1" msgid="0"

regardless the fact that the default action is set to drop. I got an alert for this event (however, I can see the those attacts under the IPS: Top blocked attacks)

I've created the rule on the advanced entry

Reply

0 wingman over 16 years ago in reply to wingman

same issue with another rule

2009:04:09-19:19:56 Astaro barnyard[6010]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited" group="420" srcip="195.74.241.211" dstip="192.168.2.40" proto="1" srcport="3" dstport="10" sid="486" class="Misc activity" priority="3"  generator="1" msgid="0"

Children

No Data