Firewall Intrusion Prevention Technologies · Topic 1 of 2

Intrusion Overview and Intrusion Prevention

Learn intrusion types, IDS versus IPS, the IPS detection process, signatures, signature filters, exception signatures and IPS profiles on USG firewalls.

5 min

In a nutshell

Intrusions include scanning, vulnerability exploits, web attacks, malicious code, DoS and DDoS, and APT.
IDS is off path and alerts; IPS is inline and blocks in real time.
IPS reassembles traffic, identifies and parses the protocol, matches signatures, then acts.

What it is

An intrusion is any attempt to break the confidentiality, integrity or availability of a system, from scanning for open ports to exploiting a vulnerability and taking control. A security policy that checks addresses and ports cannot see most of these attacks, because they hide in the content of permitted traffic.

IPS (Intrusion Prevention System) inspects that content, compares it with known attack patterns called signatures, and blocks matching traffic in real time. On a USG firewall, IPS is a profile that a security policy applies to the traffic it permits.

How it works

Common types of intrusion

Type	What the attacker does
Scanning and probing	Sweeps addresses and ports to find live hosts, services and versions
Vulnerability exploitation	Sends crafted input, such as a buffer overflow, to run code on a target
Web attacks	SQL injection, cross site scripting and similar attacks on web applications
Malicious code	Spreads viruses, worms, Trojan horses or ransomware
DoS and DDoS	Floods a target so legitimate users cannot reach it
APT	A long, targeted campaign that combines several of the above and stays hidden

IDS versus IPS

Item	IDS	IPS
Position	Off path, receives a copy of traffic, such as from a mirrored port	Inline, traffic passes through it
Response	Detects and alerts	Detects and blocks in real time
Effect of a false positive	An unneeded alert	Legitimate traffic is dropped
Effect of a failure	Traffic is not affected	Traffic can be interrupted unless bypass is available

IDS tells you an attack happened. IPS stops it, which is why the firewall integrates IPS inline with its other checks.

The IPS detection process

The firewall first reassembles fragmented packets and TCP streams, so an attack split across packets cannot slip through. It then identifies the application protocol, such as HTTP or FTP, whatever port it uses, and parses the protocol fields.

The parsed data is matched against the signature database. If a signature matches, the firewall takes the configured action, and logs the event.

Signatures

A signature describes the features of one attack or vulnerability. Predefined signatures come from Huawei's signature database, which is updated online and needs a valid license; user defined signatures are written by the administrator for special cases.

Signature attribute	Meaning
ID and name	Identify the signature
Object	Whether the attack targets the client or the server
Severity	How dangerous the attack is
Protocol	The protocol the attack uses
Threat category	Such as vulnerability, worm or scanning
Operating system	The systems the attack affects
Default action	Alert or block, set by Huawei

Signature filters and exception signatures

There are thousands of signatures, so they are selected by attribute rather than one by one.

Element	What it does	Possible actions
Signature filter	Selects all signatures matching chosen attributes, such as object server and severity high	Use the signature's default action, alert, or block
Exception signature	Sets a different action for one signature, by ID	Such as alert, block or allow

An exception signature has priority over the filter. It is the tool for a false positive: a signature that blocks legitimate traffic can be set to allow or alert without disabling the whole filter.

Applying an IPS profile

The signature filters and exceptions are grouped in an IPS profile, and the profile is referenced in a security policy rule.

profile type ips name ips_web
#
security-policy
 rule name untrust_to_web
  source-zone untrust
  destination-zone dmz
  destination-address 10.2.0.7 32
  service http
  action permit
  profile ips ips_web
#
engine configuration commit

engine configuration commit activates new or changed profiles in the content inspection engine. Traffic that the rule denies is never inspected, because it is already dropped.

A worked example

A web server in the DMZ is published to the internet. The engineer creates an IPS profile with a filter for server-side signatures of high severity set to block, and applies it to the Untrust to DMZ security policy.

A week later, a business application fails because one signature mistakes its requests for an attack. The engineer adds an exception signature with that ID and the action alert, so the application works and the event is still logged.

How the exam asks about this

"What is the main difference between IDS and IPS?" -> IPS is inline and blocks attacks in real time; IDS detects and alerts.
"Which IPS element sets the action of one specific signature?" -> An exception signature.
"What must reference the IPS profile for it to inspect traffic?" -> A security policy rule whose action is permit.

What to remember for the exam

Intrusions include scanning, vulnerability exploits, web attacks, malicious code, DoS and DDoS, and APT.
IDS is off path and alerts; IPS is inline and blocks in real time.
IPS reassembles traffic, identifies and parses the protocol, matches signatures, then acts.
A signature filter selects signatures by attributes; an exception signature overrides the action of one signature.
An IPS profile takes effect through a permit security policy, and changes are activated with engine configuration commit.

Watch out

IPS inspects only traffic that a security policy permits and references the profile. A deny rule drops traffic before IPS ever sees it, and a permit rule without the profile is not inspected.

Common mistakes

Thinking IDS blocks attacks. An IDS receives a copy of traffic and can only alert; blocking needs an inline IPS.

Disabling a whole filter for one false positive. Use an exception signature for that one signature, and keep protection for the rest.

Forgetting the signature database. Predefined signatures detect only attacks the database knows, so it must be updated, which requires a license.

Check yourself

Why does IPS reassemble packets before matching signatures?
An attack split across fragments or TCP segments would not match a signature in any single packet.
What happens when a traffic flow matches both a signature filter and an exception signature?
The exception signature's action applies, because exceptions have priority over filters.
Where is an IPS profile applied on a USG firewall?
In a security policy rule with the action permit, using profile ips followed by the profile name.

Topic 1 of 2 in Firewall Intrusion Prevention Technologies

Test yourself on Firewall Intrusion Prevention Technologies

The full Huawei HCIA-Security H12-711 question bank has 600 questions, with timed practice exams and an explanation for every answer.

Get Full Access Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Huawei. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.