IPS, Firewall Deployment Models and Telemetry

What it is

Firewalls and intrusion prevention systems enforce policy on traffic, and telemetry shows you what the network is actually doing.

A next generation firewall (NGFW) adds application awareness, user identity and threat inspection to stateful filtering. A next generation IPS (NGIPS) inspects traffic for exploits and can block them. On Cisco Secure Firewall, one Threat Defense (FTD) image provides both functions.

How it works

You choose a deployment model by how the device sits in the path, and how much it may interfere with traffic.

Deployment models

A routed firewall has IP addresses on its interfaces and acts as the gateway. A transparent firewall bridges the same subnet on both sides, so you can insert it without readdressing. An inline IPS interface pair passes traffic through and can drop it.

A passive deployment is for visibility only. The sensor sees a copy of the traffic, so it can detect but cannot stop an attack. Use it to test policy or when the device must never affect production traffic.

Placement and resilience

Common places are the internet edge, the data centre and between internal zones. Pairs of firewalls run in high availability, where one is active and one is standby. Larger sites can use clustering, where several units share the load.

Inspection features

A modern firewall combines several functions in a single policy path.

• Access control: zones, networks, users and applications decide permit or block.
• IPS: signatures and anomaly rules detect exploits. Snort is the engine in Cisco Secure Firewall.
• Malware and file inspection: looks at files in transit and retrospective verdicts.
• URL filtering: controls web categories and reputation.

Telemetry sources

Telemetry is data that devices send out about themselves and their traffic. Each source answers a different question.

NetFlow records describe conversations, not content, so they are cheap to store and good for spotting scans and data theft. Cisco Secure Network Analytics uses flow data to build a baseline and flag unusual behaviour. SPAN gives full packets, which suits detailed analysis but costs more capacity.

Example: flow export and SPAN on IOS XE

R1(config)# flow exporter EXPORTER1
R1(config-flow-exporter)# destination 10.1.1.50
R1(config-flow-exporter)# transport udp 2055
R1(config)# flow monitor MONITOR1
R1(config-flow-monitor)# exporter EXPORTER1
R1(config-flow-monitor)# record netflow ipv4 original-input
R1(config)# interface GigabitEthernet0/1
R1(config-if)# ip flow monitor MONITOR1 input

Switch(config)# monitor session 1 source interface GigabitEthernet0/1 both
Switch(config)# monitor session 1 destination interface GigabitEthernet0/24

The first block exports flow records from an interface to a collector. The second copies traffic from one port to a port where a sensor is connected.

Putting telemetry to work

Logs, flows and packet data are most useful when they flow into one place. A SIEM correlates them, and analytics tools learn what normal looks like. Time must be accurate on all devices, or events cannot be lined up, so NTP is part of monitoring too.