FMC - Intrusion event passes instead of drop

[hash2k2]

Hi,

this morning I found in my FMC that some intrusion events are shown as "pass" instead of being dropped.

I find this in my FMC under Analysis -> Intrusion Events -> Table view.

example:

2022-02-26 06:45:38

low

Pass

xx.xx.xx.xx

USA

xx.xx.xx.xx

USA

3200 / tcp

80 (http) / tcp

HI_CLIENT_IIS_UNICODE (119:7:1)

Unknown Traffic

HTTP Inspection Preprocessor

This happened for different events and different target machines.

I am running FMC with 7.1.0

VDB is 351

Is that a normal behavior? I have not seen this in the event table before, but I am not that into the fmc at the moment...

[hurricane05]

Was there a custom IPS rule created from one of the Cisco default ruleset and configured it as a Pass for valid traffic? I normally do this for different signatures where I want Snort to pass traffic for some of our internal host communications. Just a thought.

[hash2k2]

No, we have not created any rule to pass. And it is not always the same Snort rule / vulnerabilty that ia affected.

A few examples:

2022-02-28 02:11:59

high

Pass

x.x.x.x

USA

x.x.x.x

USA

43300 / tcp

80 (http) / tcp

SERVER-WEBAPP Zeroshell Linux Router command injection attempt (1:54794:2)

2022-02-27 22:57:29

low

Pass

x.x.x.x

DEU

x.x.x.x

DEU

38923 / tcp

80 (http) / tcp

HI_CLIENT_BARE_BYTE (119:4:1)

2022-02-27 22:50:27

low

Pass

x.x.x.x

DEU

x.x.x.x

USA

38923 / tcp

21 (ftp) / tcp

FTPP_FTP_TELNET_CMD (125:1:2)

2022-02-27 22:50:27

medium

Pass

x.x.x.x

DEU

x.x.x.x

USA

38923 / tcp

21 (ftp) / tcp

FTPP_FTP_INVALID_CMD (125:2:2)

[Marvin Rhoads]

Check the rule allowing the traffic in the first place. Does it have the Intrusion Policy specified in it?

[hash2k2]

For every services reachable from external sources I have created an own intrusion policy. Then I have created access policies for every server saying any -> dmz server and added that specific IPS policy. So there is no entry without an IPS policy with allow.