Threat Containment across MPLS (WAN) links

[tyagi.v]

Hi ,

As per the enclosed topology we want to restrict ransomware or other kind of threat to spread across different office locations through MPLS links , what are the best solution for this kind of environment ?

Vijay

[phil.hydea]

Hi Vijay

For network/perimeter:

Depending on what routers you're using for the MPLS legs; you could use FTD for ISR. Also consider FTD NGFWs placed behind the routers.

The main Cisco security features are Security Intelligence blacklisting (related Malware category) based on IP address, DNS and URL. This will block any inbound/outbound connections to any blacklisted object.

Also there are regularly updated Snort rules that can block the files in transit.

FireAMP will provide cloud lookup,network trajectory analysis and cloud sandboxing (keep in mind the network version of this can increase the performance load on the FTD).

Hope this helps.

Phil