Configuration · Topic 5 of 9
Objects and Intrusion Rules
Learn how the FMC Object Management page stores reusable objects, and how intrusion policies, variable sets and custom intrusion rules are built.
- 4 min
- Objects are reusable values that you edit once for every policy that uses them.
- A security zone groups interfaces of the same type.
- Overrides give an object a different value on a chosen device.
What it is
Objects are reusable building blocks, and intrusion rules are the signatures that detect attacks.
An object holds a value such as a network, a port or a zone. You create it once in Object Management in the Secure Firewall Management Center (FMC), and use it in many policies. If the value changes, you edit the object and every policy follows.
An intrusion rule describes traffic that looks like an attack. Rules are grouped into an intrusion policy, which an access control rule applies to allowed traffic.
How it works
Objects keep configuration tidy, and intrusion policies decide which signatures run.
Object types
Object Management has many object types. The most common are in this table.
| Object type | Holds |
|---|---|
| Network | A host, range, network or FQDN, and groups of them |
| Port | A protocol and port or range |
| Interface | Security zones and interface groups |
| Application filter | A set of applications chosen by traits |
| URL | One or more website addresses |
| Variable set | Values such as HOME_NET and EXTERNAL_NET |
| PKI | Certificate enrolments and trusted authorities |
| SLA monitor | A reachability check for route tracking |
| Route map, prefix list | Routing policy tools |
| AAA server | RADIUS and other authentication servers |
Security zones deserve special mention. A security zone groups interfaces of the same type, and policies use zones to say where traffic comes from and goes to.
Why objects help
Using objects stops you typing the same address into many rules. Naming them gives a clear policy, such as a network object called SERVERS.
Overrides let one object take a different value on a chosen device. This helps when branch offices share a policy but have their own subnets.
Intrusion policy
An intrusion policy starts from a base policy, and the common bases are Connectivity Over Security, Balanced Security and Connectivity, Security Over Connectivity and Maximum Detection.
Each rule in the policy has a state. A rule can be disabled, set to generate events only, or set to drop traffic and generate events. In inline mode, the drop state blocks the packet.
The variable set tells the rules what your network looks like. HOME_NET is your protected address space, and EXTERNAL_NET is everything else. A default variable set exists, and you should set HOME_NET to your real networks.
Rules arrive through rule updates. Snort 2 uses the Snort Rule Update (SRU), and Snort 3 uses a Lightweight Security Package (LSP).
Custom intrusion rules
You can write a local rule when you need a signature of your own. A rule has a header and options.
alert tcp any any -> 10.1.1.0/24 80 (msg:"Admin path request"; flow:to_server,established; content:"/admin"; sid:1000001; rev:1;)The header gives the action, protocol, source, destination and direction. The options inside the brackets give the message, the flow direction, the content to match, a signature ID and a revision.
Local rule IDs start from 1000000 so that they do not clash with Cisco rules. After you create a rule you enable it in an intrusion policy, and then deploy.
What to remember for the exam
Eight facts cover the usual questions.
- Objects are reusable values that you edit once for every policy that uses them.
- A security zone groups interfaces of the same type.
- Overrides give an object a different value on a chosen device.
- An intrusion policy starts from a base policy such as Balanced Security and Connectivity.
- Rule states are disabled, generate events, and drop and generate events.
- HOME_NET in the variable set should hold your protected networks.
- Snort 2 gets rules through SRU and Snort 3 through LSP.
- Local rules use IDs from 1000000 upward.
To block with an intrusion rule, the rule state must drop and the device must be inline, not passive or tap mode.
Common mistakes
These four mistakes are common with objects and rules.
Leaving HOME_NET as any. Rules that rely on it then fit your network poorly.
Enabling a drop rule on a passive deployment. The packet cannot be dropped, and only an event appears.
Typing addresses into each rule. An object avoids repeated edits.
Writing a rule and forgetting to enable it. A new rule does nothing until an intrusion policy turns it on.
Maximum Detection raises load and false alerts. Start from Balanced Security and Connectivity and tune from there.
Check yourself
Work through these three questions.
What is the benefit of using a network object in many rules?
You edit the value once and every policy that uses the object follows.
What does the HOME_NET variable describe?
It holds your protected address space, and EXTERNAL_NET is everything else.
How do Snort 2 and Snort 3 receive new intrusion rules?
Snort 2 uses the Snort Rule Update, SRU, and Snort 3 uses a Lightweight Security Package, LSP.
Topic 5 of 9 in Configuration
Test yourself on Configuration
The full Cisco CCNP 300-710 SNCF question bank has 865 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.