Configuration · Topic 3 of 9
DNS, Identity and Network Analysis Policies
Learn how DNS policy rules and actions, identity policy and realms, and network analysis policies work with the access control policy in Secure Firewall.
- 4 min
- A DNS policy is selected in the Security Intelligence settings of the access control policy.
- DNS rule actions are whitelist, monitor, domain not found, drop and sinkhole.
- A sinkhole returns the address of a server you control so that you can see infected hosts.
What it is
DNS, identity and network analysis policies are supporting policies that you attach to an access control policy.
A DNS policy acts on domain names before a connection starts. An identity policy ties traffic to users. A network analysis policy (NAP) sets how traffic is prepared for inspection.
Each one is built as its own object in the Secure Firewall Management Center (FMC), and the access control policy points to it.
How it works
Each policy has its own rules and its own place in the processing order.
DNS policy
A DNS policy has rules that match on DNS lists and feeds, and each rule has an action. The policy is selected in the Security Intelligence settings of the access control policy.
| Action | Result |
|---|---|
| Whitelist (allow) | Lets the lookup through without applying the remaining DNS rules |
| Monitor | Logs the lookup and lets it through |
| Domain not found | Returns a reply that says the domain does not exist |
| Drop | Drops the DNS request |
| Sinkhole | Returns the address of a sinkhole server |
A sinkhole sends the client to a server you control. You can then see which hosts try to reach a bad domain, because they connect to the sinkhole instead.
Identity policy
An identity policy decides how the firewall learns which user is behind an IP address. It uses a realm, which is a link to a directory such as Active Directory, and it uses rules.
Identity can be learned passively, from another source such as Cisco ISE. It can also be learned actively, by asking the user to log in through a captive portal. VPN logins give identity too.
The common rule actions are passive authentication, active authentication, VPN authentication and no authentication.
Once the firewall knows the user, access control rules can match on users and groups. Events also show the user name, which helps when you read them.
Network analysis policy
Before the intrusion engine reads traffic, inspectors prepare it. They decode protocols, rebuild streams and normalise packets.
A network analysis policy holds the settings for those inspectors. In Snort 2 they are called preprocessors, and in Snort 3 they are called inspectors.
The access control policy has a default network analysis policy. You can also add network analysis rules that apply a different NAP to traffic from chosen zones, networks or ports.
| Preset | Leans towards |
|---|---|
| Connectivity Over Security | Fewer checks, fewer false alerts |
| Balanced Security and Connectivity | A middle choice and the usual default |
| Security Over Connectivity | More checks |
| Maximum Detection | The most checks, with higher load |
Putting them in order
The identity policy sets who the user is, and the DNS policy and Security Intelligence act early. The access control rules then decide the action, and the NAP and intrusion policy shape inspection of allowed traffic.
Deploying
All three policies reach the device only through a deployment. A change to a DNS rule, a realm or a NAP needs a deploy before the firewall acts on it.
What to remember for the exam
Eight facts cover the usual questions.
- A DNS policy is selected in the Security Intelligence settings of the access control policy.
- DNS rule actions are whitelist, monitor, domain not found, drop and sinkhole.
- A sinkhole returns the address of a server you control so that you can see infected hosts.
- An identity policy uses a realm, which links to a directory.
- Identity can be passive, active or from a VPN login.
- Access control rules can match users and groups once identity is known.
- A network analysis policy sets inspector settings and does not choose block or allow.
- The default network analysis policy is usually Balanced Security and Connectivity.
If a question asks how to find hosts that look up a bad domain, think of a DNS policy with a sinkhole action.
Common mistakes
These four mistakes are common here.
Expecting a NAP to block traffic. It prepares traffic for inspection, and rules and policies decide the verdict.
Forgetting the realm. Without a realm there is no user data to match.
Assuming DNS policy works without the access control policy. It must be selected in the access control policy.
Choosing Maximum Detection everywhere. It raises load and false alerts.
Identity rules that actively authenticate users need the user to be able to reach the captive portal. Test it before you deploy widely.
Check yourself
Work through these three questions.
What does a sinkhole action do in a DNS policy?
It returns the address of a server you control, so hosts that look up a bad domain connect there and can be identified.
What does a realm provide to the identity policy?
It links the firewall to a directory, so users and groups can be matched.
Does a network analysis policy decide if traffic is blocked?
No. It sets how traffic is prepared for inspection, and the rules and intrusion policy decide the verdict.
Topic 3 of 9 in Configuration
Test yourself on Configuration
The full Cisco CCNP 300-710 SNCF question bank has 865 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.