Arg! The money spent the month before I stated here.

JaredBusch

@wrx7m said in Arg! The money spent the month before I stated here.:

@jaredbusch Right but my question was related to ACLs, not IDS/IPS.

Then you need to define what you are after. Of course the firewall uses rules. There is not a firewall in existence that does not.

Here are the firewall rules currently in my ERL at home.

jbusch@jared# show firewall 
 all-ping enable
 broadcast-ping disable
 group {
     address-group Strongarm.io {
         address 54.174.40.213
         address 52.3.100.184
         description ""
     }
 }
 ipv6-receive-redirects disable
 ipv6-src-route disable
 ip-src-route disable
 log-martians enable
 name LAN_IN {
     default-action accept
     description "Wired and Wireless LAN to Internet"
     rule 2 {
         action reject
         description "Block Port 25"
         destination {
             port 25
         }
         log enable
         protocol tcp
     }
 }
 name LAN_LOCAL {
     default-action accept
     description "Wired and Wireless LAN to Router"
 }
 name WAN_IN {
     default-action drop
     description "WAN to internal"
     rule 10 {
         action accept
         description "Allow established/related"
         state {
             established enable
             related enable
         }
     }
     rule 20 {
         action drop
         description "Drop invalid state"
         state {
             invalid enable
         }
     }
 }
 name WAN_LOCAL {
     default-action drop
     description "WAN to router"
     rule 10 {
         action accept
         state {
             established enable
             related enable
         }
     }
     rule 20 {
         action drop
         log enable
         state {
             invalid enable
         }
     }
     rule 30 {
         action accept
         description "Allow Pings to Router"
         limit {
             burst 1
             rate 62/minute
         }
         log enable
         protocol icmp
     }
     rule 40 {
         action accept
         description "Allow IPSEC"
         ipsec {
             match-ipsec
         }
         log disable
         protocol all
         state {
             established disable
             invalid disable
             new enable
             related disable
         }
     }
 }
 name WAN_OUT {
     default-action accept
     description ""
     rule 1 {
         action accept
         description "Allows Strongarm.io DNS"
         destination {
             group {
                 address-group Strongarm.io
             }
             port 53
         }
         log disable
         protocol udp
         state {
             established enable
             invalid disable
             new enable
             related disable
         }
     }
     rule 2 {
         action drop
         description "Block all DNS"
         destination {
             port 53
         }
         log enable
         protocol udp
         state {
             established enable
             invalid enable
             new enable
             related enable
         }
     }
 }

wrx7m

@jaredbusch I know firewalls use rules. In Sophos and Sonicwall and others, I'm sure, you can define a host, network and service and call it something like ServerA and drag and drop the hosts/ip address, services and networks to create the rules.

wrx7m

@storageninja said in Arg! The money spent the month before I stated here.:

@wrx7m said in Arg! The money spent the month before I stated here.:

@jaredbusch Right but my question was related to ACLs, not IDS/IPS.

Did they have compliance requirements that would drive IDS/IPS? Honestly, I wouldn't deploy an office network without some sort of layer 7 edge inspection. Users are just too dumb...

The modern argument against proxy and IDS/IPS is that you have to set it up so that your proxy device is the man in the middle and decrypts and encrypts everything again.

scottalanmiller

@wrx7m said in Arg! The money spent the month before I stated here.:

@storageninja said in Arg! The money spent the month before I stated here.:

@wrx7m said in Arg! The money spent the month before I stated here.:

@jaredbusch Right but my question was related to ACLs, not IDS/IPS.

Did they have compliance requirements that would drive IDS/IPS? Honestly, I wouldn't deploy an office network without some sort of layer 7 edge inspection. Users are just too dumb...

The modern argument against proxy and IDS/IPS is that you have to set it up so that your proxy device is the man in the middle and decrypts and encrypts everything again.

That was an old argument, too

wrx7m

@scottalanmiller Right, but now almost everything is HTTPS.

travisdh1

@storageninja said in Arg! The money spent the month before I stated here.:

@wrx7m said in Arg! The money spent the month before I stated here.:

@jaredbusch Right but my question was related to ACLs, not IDS/IPS.

Did they have compliance requirements that would drive IDS/IPS? Honestly, I wouldn't deploy an office network without some sort of layer 7 edge inspection. Users are just too dumb...

No compliance related things, yet at least.

scottalanmiller

@wrx7m said in Arg! The money spent the month before I stated here.:

@scottalanmiller Right, but now almost everything is HTTPS.

Oh, I see what you mean.

JaredBusch

@wrx7m said in Arg! The money spent the month before I stated here.:

@jaredbusch I know firewalls use rules. In Sophos and Sonicwall and others, I'm sure, you can define a host, network and service and call it something like ServerA and drag and drop the hosts/ip address, services and networks to create the rules.

An ACL provides rules applied to IP address and ports.

What you are describing is not an ACL. It is a group or list of information applied to an ACL.

In the VyOS/EdgeMax world, you can see an example in my router snippet above. I have a firewall group named Strongarm.io that is an address group of two addresses.

That group is applied to rule 1 of ACL named WAN_OUT

StorageNinja

@wrx7m said in Arg! The money spent the month before I stated here.:

@jaredbusch I know firewalls use rules. In Sophos and Sonicwall and others, I'm sure, you can define a host, network and service and call it something like ServerA and drag and drop the hosts/ip address, services and networks to create the rules.

An object based rule engine. This is what most modern firewalls have moved to.

StorageNinja

@wrx7m Inbound attacks on systems you are hosting it's still an issue (and yes, your IDS/F5/LB's need to terminate SSL for this to work). On the outbound traffic, there's a lot that can be inferred from what/where you are talking to. If someone is phoning home to a known bot C&C system then you likely want to know that...

Obsolesce

A lot of malware such as ransomware is delivered from legitimate SSL sites that have been hacked.

So if you don't have some kind of SSL Inspection (like SonicWALL's SSL-DPI), then you are solely relying on your users' AV and ability to spot fake "java update" ads for example.

scottalanmiller

@tim_g said in Arg! The money spent the month before I stated here.:

A lot of malware such as ransomware is delivered from legitimate SSL sites that have been hacked.

So if you don't have some kind of SSL Inspection (like SonicWALL's SSL-DPI), then you are solely relying on your users' AV and ability to spot fake "java update" ads for example.

You are relying on the same thing in both cases, just one runs no a central processor and one runs closer to the end user. Same scanning functionality, though.

scottalanmiller

@tim_g said in Arg! The money spent the month before I stated here.:

...and ability to spot fake "java update" ads for example.

No, that's not how that works. Anything that runs on the router can be run on the client machine. The idea that UTM can do something that traditional AV cannot is incorrect. It's the same thing, just one runs on a low powered shared machine and one runs on the high powered desktop.

Obsolesce

@scottalanmiller said in Arg! The money spent the month before I stated here.:

@tim_g said in Arg! The money spent the month before I stated here.:

A lot of malware such as ransomware is delivered from legitimate SSL sites that have been hacked.

So if you don't have some kind of SSL Inspection (like SonicWALL's SSL-DPI), then you are solely relying on your users' AV and ability to spot fake "java update" ads for example.

You are relying on the same thing in both cases, just one runs no a central processor and one runs closer to the end user. Same scanning functionality, though.

Security in layers... why not one at the gateway?

Obsolesce

@scottalanmiller said in Arg! The money spent the month before I stated here.:

@tim_g said in Arg! The money spent the month before I stated here.:

...and ability to spot fake "java update" ads for example.

No, that's not how that works. Anything that runs on the router can be run on the client machine. The idea that UTM can do something that traditional AV cannot is incorrect. It's the same thing, just one runs on a low powered shared machine and one runs on the high powered desktop.

It works because one protects against stuff that bypasses the firewall... like if you plug in an infected USB stick, or some other means of bypassing the firewall.

And the other helps against things that pass do through the firewall (like a pc connecting to the internet). Both together are better.

The SonicWALL may catch something the other does not.

The SonicWALL may deny something that an unprotected device can't see... like an iPAD with no antivirus or a cell phone on the wireless network.

travisdh1

@tim_g said in Arg! The money spent the month before I stated here.:

@scottalanmiller said in Arg! The money spent the month before I stated here.:

@tim_g said in Arg! The money spent the month before I stated here.:

...and ability to spot fake "java update" ads for example.

No, that's not how that works. Anything that runs on the router can be run on the client machine. The idea that UTM can do something that traditional AV cannot is incorrect. It's the same thing, just one runs on a low powered shared machine and one runs on the high powered desktop.

It works because one protects against stuff that bypasses the firewall... like if you plug in an infected USB stick, or some other means of bypassing the firewall.

And the other helps against things that pass through the firewall. Both together are better.

Why do you need to pay so much money when you can get the same functionality free? That's my beef, not that security in-depth isn't a good thing.

Obsolesce

@travisdh1 said in Arg! The money spent the month before I stated here.:

@tim_g said in Arg! The money spent the month before I stated here.:

@scottalanmiller said in Arg! The money spent the month before I stated here.:

@tim_g said in Arg! The money spent the month before I stated here.:

...and ability to spot fake "java update" ads for example.

No, that's not how that works. Anything that runs on the router can be run on the client machine. The idea that UTM can do something that traditional AV cannot is incorrect. It's the same thing, just one runs on a low powered shared machine and one runs on the high powered desktop.

It works because one protects against stuff that bypasses the firewall... like if you plug in an infected USB stick, or some other means of bypassing the firewall.

And the other helps against things that pass through the firewall. Both together are better.

Why do you need to pay so much money when you can get the same functionality free? That's my beef, not that security in-depth isn't a good thing.

Where do you get good SSL-DPI for free, with reliable gateway AV?

Obsolesce

@scottalanmiller said in Arg! The money spent the month before I stated here.:

@tim_g said in Arg! The money spent the month before I stated here.:

...and ability to spot fake "java update" ads for example.

No, that's not how that works. Anything that runs on the router can be run on the client machine. The idea that UTM can do something that traditional AV cannot is incorrect. It's the same thing, just one runs on a low powered shared machine and one runs on the high powered desktop.

I meant the user spot fake ads there.

travisdh1

@tim_g said in Arg! The money spent the month before I stated here.:

@travisdh1 said in Arg! The money spent the month before I stated here.:

@tim_g said in Arg! The money spent the month before I stated here.:

@scottalanmiller said in Arg! The money spent the month before I stated here.:

@tim_g said in Arg! The money spent the month before I stated here.:

...and ability to spot fake "java update" ads for example.

No, that's not how that works. Anything that runs on the router can be run on the client machine. The idea that UTM can do something that traditional AV cannot is incorrect. It's the same thing, just one runs on a low powered shared machine and one runs on the high powered desktop.

It works because one protects against stuff that bypasses the firewall... like if you plug in an infected USB stick, or some other means of bypassing the firewall.

And the other helps against things that pass through the firewall. Both together are better.

Why do you need to pay so much money when you can get the same functionality free? That's my beef, not that security in-depth isn't a good thing.

Where do you get good SSL-DPI for free, with reliable gateway AV?

Every proxy server around offers that.

Obsolesce

@travisdh1 said in Arg! The money spent the month before I stated here.:

@tim_g said in Arg! The money spent the month before I stated here.:

@travisdh1 said in Arg! The money spent the month before I stated here.:

@tim_g said in Arg! The money spent the month before I stated here.:

@scottalanmiller said in Arg! The money spent the month before I stated here.:

@tim_g said in Arg! The money spent the month before I stated here.:

...and ability to spot fake "java update" ads for example.

No, that's not how that works. Anything that runs on the router can be run on the client machine. The idea that UTM can do something that traditional AV cannot is incorrect. It's the same thing, just one runs on a low powered shared machine and one runs on the high powered desktop.

It works because one protects against stuff that bypasses the firewall... like if you plug in an infected USB stick, or some other means of bypassing the firewall.

And the other helps against things that pass through the firewall. Both together are better.

Why do you need to pay so much money when you can get the same functionality free? That's my beef, not that security in-depth isn't a good thing.

Where do you get good SSL-DPI for free, with reliable gateway AV?

Every proxy server around offers that.

Have fun with that.