1

2 Device management refers to the IDS Sensor's ability to dynamically reconfigure the filters and access control lists (ACL) on a router, switch, and firewall to shun an attacker. This functionality is provided by the managed service.

3 Shunning refers to the IDS Sensor's ability to use a network device to deny entry to a specific network host or an entire network. There are three major steps toward using a router or other device to shun an attacker:

4 Set Up Device Management Set Up Device Management Set Up Shunning Set Up Shunning Set Up Intrusion Detection Set Up Intrusion Detection

5 An intrusion detection systems has its core element - a sensor (an analysis engine) that is responsible for detecting intrusions. Sensor properties 

6 Each sensor maintains signatures configured for the segment it monitors. -Inserts TCP resets via the monitoring interface. -Inserts TCP resets via the monitoring interface. -Makes ACL changes to block traffic on routers (or PIX Firewall or Cisco Catalyst 6000 switches) that the sensor manages. -Provides information for alert response/behavior

7 Where to locate sensors? -In loc.1, the sensor is placed to monitor traffic between the protected network and the Internet. -In loc.2, the sensor is monitoring an extranet connection with a business partner. -In loc.3, the sensor is monitoring the network side of a remote access server. In loc.4, the sensor is monitoring an intranet connection

8 Step 1. On the Director interface, click the remote machine you want to configure. Step 2. Click Configure on the Security menu.

9 This presentation uses the network setup shown in this diagram.

10 Add the Sensor into the Director

11

12 After we add the sensor from the Main Menu, we should see sensor-2, as in this example

13

14. Add the range to into the protected network, as shown in this example.

15 Enabling daemons:

16 Once the Sensor has detected the attack, and the ACL is downloaded, and this output is displayed on "House." -house#show access-list Extended IP access list IDS_FastEthernet0/0_in_0 permit ip host any deny ip host any (459 matches) permit ip any any Fifteen Minutes later, "House" goes back to normal, because shunning was set to 15 minutes. -House#show access-list Extended IP access list IDS_FastEthernet0/0_in_1 permit ip host any permit ip any any (12 matches)house# "Light" can ping "House." Light#ping Light#ping

17 Configure Pix Firewall using IDS Sensor How to configure shunning on a PIX using Cisco IDS UNIX Director (formerly known as Netranger Director) and Sensor.

18 This configuration presentation uses the network setup shown in the diagram below.

19 The following steps describe how to configure the Sensor. Telnet to with username root and password attack. Enter sysconfig-sensor. Enter the following information: IP Address : IP Address : IP Netmask : IP Netmask : IP Host Name: sensor-2 IP Host Name: sensor-2 Default Route Default Route Network Access Control Network Access Control10. Communications Infrastructure Communications Infrastructure Sensor Host ID: 49 Sensor Organization ID: 900 Sensor Host Name: sensor-2 Sensor Organization Name: cisco Sensor IP Address: IDS Manager Host ID: 50 IDS Manager Organization ID: 900 IDS Manager Host Name: dir3 IDS Manager Organization Name: cisco IDS Manager IP Address: Save the configuration and the Sensor will reboot.

20 Adding the Sensor Into the Director Telnet to with username netrangr and password attack Enter ovw& to launch HP OpenView In the Main Menu, go to Security > Configure. In the Netranger Configuration Menu, go to File > Add Host, and click Next. Enter the following information, and click Next.

21

22

23 You have successfully added the sensor into the director.

24 In the Main Menu, go to Security > Configure. In the Netranger Configuration Menu, highlight sensor-2 and double click it. Open Device Management. Click Devices > Add, enter the information as shown in the following example. Click OK to continue. The Telnet and enable password are both “Cisco.”

25

26 Click Shunning > Add. Add host

27 Click Shunning > Add, to select sensor-2.cisco as the shunning servers.

28 Open the Intrusion Detection window and click Protected Networks. Add to into the protected network.

29 Click Profile and select Manual Configuration > Modify Signatures. Select Large ICMP Traffic and ID: 2151, click Modify, change the Action from None to Shun and Log. Click OK to continue.

30 Open the System Files folder, open the Daemons window. Make sure you have enabled following daemons.

31 Click OK to continue, and select the version you just modified. Click Save > Apply. Wait for the system to tell you the Sensor is finished, restart Services, and close all the windows for the Netranger configuration

32 Before Launching the Attack Tiger(config)# show telnet inside Tiger(config)# who 0: Tiger(config)# show xlate 1 in use, 1 most used Global Local static Light#ping

33 -Success rate is 100 percent (5/5), round-trip min/avg/max = 1/3/4 ms. -Shunning is done for indicated IP addresses. -Fifteen minutes later, it goes back to normal because the shunning is set to 15 minutes.