cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

1734
Views
5
Helpful
6
Replies
Highlighted
Beginner

Firepower is not dropping packets. How to enable rules to generate events

Hello community

I am trying to generate some events in order to monitor my environment, but I am facing some issues.

I want to drop connections which use "public" or "private" community on snmp gets, but I am being not successfull.

I would appreciate some help.

I am trying to establish a connection to a switch/router using "public" community. I get no answer because that community is not configured, but I'd like to drop that try using firepower resources.

 

I attach my config.

It seems that the connection crosses the FW:

Oct 03 2018 08:53:07: %ASA-6-302015: Built inbound UDP connection 181208 for OUTSIDE:10.3.51.97/54829 (10.3.51.97/54829) to INSIDE:10.1.51.1/161 (10.1.51.1/161)

 

And is being inspected:

ASA-CDS-1# sho conn | in 10.1.51.1
UDP OUTSIDE 10.3.51.97:54829 INSIDE 10.1.51.1:161, idle 0:01:19, bytes 44, flags X
UDP OUTSIDE 10.3.51.97:54828 INSIDE 10.1.51.1:161, idle 0:01:37, bytes 44, flags X

 

I am using community "public" to make the request:

snmp flow.JPG

 

I enabled the rule to generate the event:

Firepower snmp rules.JPG

 

 

I commited the config and deployed to the devices.

My problem is that it seems that this is not generating intrussion events.

Enabling another rules (icmp echo reply) I can see those events.

 

Should I apply anything else?

Is this rule made for this goal?

Everyone's tags (4)
1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Beginner

Re: Firepower is not dropping packets. How to enable rules to generate events

Hello

I could fix this, I will share my config in order to help someone.

It's important to apply the Intrusion Policy on the access rule, because if traffic matches, it does not apply the default IPS policy.

Oh, and I had to reload the device too!!!!

 

snmp ACL inspection.JPG

snmp ACL logging.JPG

And rememember to enable the rule, (maybe) it is not enabled by default.

Firepower snmp ips rules.JPG

 

Here they are:

Firepower intrusion events received.JPG

View solution in original post

6 REPLIES 6
Highlighted
Hall of Fame Guru

Re: Firepower is not dropping packets. How to enable rules to generate events

Is that IPS rule in your deployed Intrusion policy?

 

If so, does the policy (or rule with that policy associated that's otherwise allowing the traffic) have "log at beginning of connection" selected?

Highlighted
Beginner

Re: Firepower is not dropping packets. How to enable rules to generate events

Hello Marvin

Thank you for your help.

 

I have applied as "default Action" and inside access rule too.
Firepower rules general.JPG

 

 

This is the config:

Firepower rule snmp inspection.JPG

Firepower rule snmp logging.JPG

 

I enabled snmp traps too, and I can see those events.

Firepower intrusion events.JPG

Highlighted
Hall of Fame Guru

Re: Firepower is not dropping packets. How to enable rules to generate events

Try "Log at Beginning of Connection".

 

A udp flow will never have a FIN packet and thus won't signal the connection is ended.

 

Also, when you change the rule to block you must log at beginning to generate events since there won't be a FIN no matter what protocol is being used.

Highlighted
Beginner

Re: Firepower is not dropping packets. How to enable rules to generate events

Hello

I tried to detect those events enabling "Log at beggining..." but it does not detect them.

 

Firepower intrusion events snmp.JPG

 

It shows snmp request or traps, but I am not able to drop a request which uses community "public".

Highlighted
Beginner

Re: Firepower is not dropping packets. How to enable rules to generate events

Hello

I could fix this, I will share my config in order to help someone.

It's important to apply the Intrusion Policy on the access rule, because if traffic matches, it does not apply the default IPS policy.

Oh, and I had to reload the device too!!!!

 

snmp ACL inspection.JPG

snmp ACL logging.JPG

And rememember to enable the rule, (maybe) it is not enabled by default.

Firepower snmp ips rules.JPG

 

Here they are:

Firepower intrusion events received.JPG

View solution in original post

Highlighted
Hall of Fame Guru

Re: Firepower is not dropping packets. How to enable rules to generate events

Thanks for sharing your solution! It helps the community as a whole.