topic Re: Firepower awareness - user, appl in Network Security

Firepower awareness - user, appl

cadet — Fri, 21 Feb 2020 17:43:56 GMT

Hello!

"Cisco Firepower provides full contextual threat analysis and protection, with awareness into users, user history on every machine, mobile devices, client-side applications, operating systems, virtual machine-to-machine communications, vulnerabilities, threats, and URLs." - https://www.cisco.com/c/m/en_us/products/security/firewalls/competitive-comparison.html#~competitive=0

What products do customers need to offer to implement the "User, network, and endpoint awareness" features?

It seems to me that in addition to Firepower + FMC, Network Visibility module for Anyconnect is also needed?

Or please explain how Firepower, which is located on the external edge of the network, receives information about "a user working on a workstation + client-side applications" in the local network behind a proxy server ?

Thanks!

Re: Firepower awareness - user, appl

Marvin Rhoads — Thu, 28 Nov 2019 11:49:18 GMT

If Firepower is only sitting on the network edge then you might not see intra-network visibility. It can be architected instead to also cover "east-west" traffic and provide the visibility mentioned in the data sheet without any additional products.

If you don't put it into the east-west path then other products such as Stealthwatch can provide this sort of visibility. It can ingest Netflow records from many locations, including the Anyconnect Network Visibility module. Generally though it suffices to gather flow records from the network equipment.

Re: Firepower awareness - user, appl

cadet — Thu, 28 Nov 2019 13:13:10 GMT

Thanks, Marvin!

As I understand, is the same situation with the "Network file trajectory" ?

"Cisco maps how hosts transfer files, including malware files, across your network. It can see if a file transfer was blocked or the file was quarantined. This provides a means to scope, provide outbreak controls, and identify patient zero." - https://www.cisco.com/c/m/en_us/products/security/firewalls/competitive-comparison.html#~competitive=0

If we don't put Firepower into the east-west path of the traffic than we can not see file trajectory across customer network without additional products such as, for example, AMP for Endpoint ?

So, in design (case 1 in attach) without AMP for Endpoint do I not see file trajectory between host B and C ?

Or do I need additional Firepower between host B and C (case 2 in attach) or AMP for Endpoint on both hosts ?

Could you correct me if I am wrong?

Re: Firepower awareness - user, appl

Marvin Rhoads — Sat, 30 Nov 2019 05:50:49 GMT

In the hypothetical use case #2 you describe, Malware traffic that was exclusively between B and C would never transit the firewall so of course the firewall would have to way to detect or provide insight into that particular flow.

However in the real world, the malware would often be making calls to the Internet. In that case Firepower would see those calls from both B and C and thus be able to report that the same malware was seen on two hosts.

See this example:

https://popravak.wordpress.com/2015/07/11/sourcefire-file-policies-aka-advanced-malware-protection/

Re: Firepower awareness - user, appl

cadet — Wed, 15 Jan 2020 12:33:51 GMT

@Marvin Rhoads wrote:
However in the real world, the malware would often be making calls to the Internet. In that case Firepower would see those calls from both B and C and thus be able to report that the same malware was seen on two hosts.

Hi!

@Marvin Rhoads, Thanks! I missed your answer.

I agree with you. But also in real-world scenarios, the customer often uses a proxy server that hides the IP addresses of users when they access to the Internet. And again we come back to a solution that requires additional software (for example, AMP for Endpoint on hosts) for Network file trajectory functionality.

Could you correct me if I am wrong?

Re: Firepower awareness - user, appl

Marvin Rhoads — Wed, 15 Jan 2020 19:02:57 GMT

@cadet If the proxy follows the conventional method of including the X-Forwarded-For (XFF) or similar field in the packets, Firepower can extract and display that information. It's a non-displayed by default so you would have to enable it in your Connection events table viewer.

The option for it is under Policies > Intrusion > Network Analysis Policy