-------------------------------------
Title:
"Intrusion Event Not Occur"
-------------------------------------
Hello,
I'm having trouble with IPS intrusion events not occurring as expected.
Test traffic that should be dropped by IPS(Snort 3),
On the FMC, Not observed as an "Intrusion Event"
(observed as Connection Event, pasted logging below).
When I did a similar test in the Snort2 environment(Firepower8120 and FMC2000) it was OK.
It is expected that,
When security violation is detected, FMC catches as "Intrusion Event",
then create "Correlation Event", finaly send from FMC to External Syslog Server.
Still, I think FTD-FMC(built in different segments) use 8305/tcp for alerting
like any other communication channel,please point out if wrong.
Do you have any Idea to solve?
Regards.
------------------------------------
(Reference: Informations)
FTD: Firepower 2140 with FTD(7.0.1.1)
FMC: Firepower Management Center 2600(7.0.1.1)
Test Traffic Route:
[PC]--(Internet)--> External:G1/1[FTD]G1/2:Internal --> [Test Server]
G1/1 and G1/2 are configured as Inline Pair.
Snort: version 3
ACP(Security Intelligence): Black List is empty
ACP(NAP): Not Configured(because of not using now)
Syslog(Policies-Action-Alerts): Configured to send External Syslog Server
Syslog(Others): Not Configured(because of not using now)
------------------------------------
(Reference: Logging on FTD)
> system support trace
Enable firewall-engine-debug too? [n]:
Please specify an IP protocol: tcp
Please specify a client IP address:
Please specify a client port:
Please specify a server IP address: 10.68.254.159
Please specify a server port: 80
Monitoring packet tracer debug messages
MidRecovery data queried. Got session type 2 rule id: 268435459, rule_action:2, rev id:2934359906, ruleMatch flag:0x0
MidRecovery data queried. Got session type 2 rule id: 268435459, rule_action:2, rev id:2934359906, ruleMatch flag:0x0
10.68.254.159 80 -> 210.162.186.194 19376 6 AS=4 ID=12 Packet 23699: TCP ***A**S*, 08/10-07:19:30.577393, seq 2407507212, ack 1166866861, dsize 0
10.68.254.159 80 -> 210.162.186.194 19376 6 AS=4 ID=12 AppID: service: (0), client: (0), payload: (0), misc: (0)
10.68.254.159 80 -> 210.162.186.194 19376 6 AS=4 ID=12 Firewall: allow rule, 'twa_acr', allow
10.68.254.159 80 -> 210.162.186.194 19376 6 AS=4 ID=12 Policies: Network 0, Inspection 0, Detection 9
10.68.254.159 80 -> 210.162.186.194 19376 6 AS=4 ID=12 Verdict: pass
210.162.186.194 19376 -> 10.68.254.159 80 6 AS=4 ID=12 Packet 23700: TCP ***A****, 08/10-07:19:30.597396, seq 1166866861, ack 2407507213, dsize 0
210.162.186.194 19376 -> 10.68.254.159 80 6 AS=4 ID=12 AppID: service: (0), client: (0), payload: (0), misc: (0)
210.162.186.194 19376 -> 10.68.254.159 80 6 AS=4 ID=12 Firewall: allow rule, 'twa_acr', allow
210.162.186.194 19376 -> 10.68.254.159 80 6 AS=4 ID=12 Policies: Network 0, Inspection 0, Detection 9
210.162.186.194 19376 -> 10.68.254.159 80 6 AS=4 ID=12 Verdict: pass
210.162.186.194 19376 -> 10.68.254.159 80 6 AS=4 ID=12 Packet 23701: TCP ***AP***, 08/10-07:19:30.597396, seq 1166866861, ack 2407507213, dsize 537
210.162.186.194 19376 -> 10.68.254.159 80 6 AS=4 ID=12 Event: 1:1108:19, Action block
210.162.186.194 19376 -> 10.68.254.159 80 6 AS=4 ID=12 Stream: pending block, drop
210.162.186.194 19376 -> 10.68.254.159 80 6 AS=4 ID=12 Policies: Network 0, Inspection 0, Detection 9
210.162.186.194 19376 -> 10.68.254.159 80 6 AS=4 ID=12 Verdict: blacklist
210.162.186.194 19376 -> 10.68.254.159 80 6 AS=4 ID=12 Verdict Reason: ips, block
