Security Support Open Mic: ISNP High Availability and Bypass

Size: px

Start display at page:

Download "Security Support Open Mic: ISNP High Availability and Bypass"

Isaac Bartholomew Bryan
5 years ago
Views:

Panelists Ed Leisure Knowledge Engineer, Presenter Andrew Sallaway SWAT Consultant Kenji Hamahata L2 Engineer (Japan) Maxime Turlot Product Lead Arthur Testa Product Lead Jeff Dicostanzo Advanced

1 Panelists Ed Leisure Knowledge Engineer, Presenter Andrew Sallaway SWAT Consultant Kenji Hamahata L2 Engineer (Japan) Maxime Turlot Product Lead Arthur Testa Product Lead Jeff Dicostanzo Advanced Value Leader Thomas Gray Senior Support Manager, Moderator Reminder: You must dial-in to the phone conference to listen to the panelists. The web cast does not include audio. USA toll-free: USA toll: Participant passcode: Slides and additional dial in numbers: IBM Security Network Protection - 28 October 2015 Security Support Open Mic: ISNP High Availability and Bypass NOTICE: By participating in this call, you give your irrevocable consent to IBM to record any statements that you may make during the call, as well as to IBM's use of such recording in any and all media, including for video postings on YouTube. If you object, please do not connect to this call.

2 Agenda High Availability Methodology Configuration Link Propagation Bypass Modes Integrated Hardware Bypass Software Bypass 2

3 High Availability Methodology

4 HA Methodology - Overview High Availability is a design characteristic that ensures operational performance in spite of hardware or software failure by reducing points of failure Two appliances cooperating to inspect all traffic Active / Active HA Topology Compatible with Load Balanced or Failover segment topologies Mirror Links Copies all traffic to partner appliance Both appliances inspect all traffic Allows each sensor to maintain connection state for inspection Flowdata is only collected from inline ports (not mirror ports) 4

HA Methodology HA Segment Topology Works in a load-balanced or failover topology The Active / Active HA methodology allows compatibility with most deployment configuration options.

5 HA Methodology HA Segment Topology Works in a load-balanced or failover topology The Active / Active HA methodology allows compatibility with most deployment configuration options. For maximum environment compatibility, the Network Protection appliance is designed to work with a switch or firewall controlled failover, and so does not perform that function. 5

6 HA Methodology - Drawbacks In a clustered environment, certain attacks such as port scans can generate duplicate event reports Identity features are essentially unusable Captive Authentication Portal is unsupported while using HA because IP addresses cannot be assigned to Protection Interfaces while HA is enabled. Any use of Authenticate (Reject) in the Network Access policy is treated as Reject if HA is enabled. Passive authentication data cannot be synchronized between partner appliances as the IBM Security Logon-event Scanner only supports sending user login events to a single device. SSL Inspection Impact SSL Decryption is performed only on inline ports. There is no state synchronization between appliances. If a failover event occurs, SSL connections must be reestablished on the new segment. This is necessary so there is no lapse on protection. In environments where traffic is routed asymmetrically, the IPS pair will be unable to inspect outbound SSL traffic. 6

7 HA Methodology HA Segment Topology Illustration 7

8 High Availability Configuration

9 HA Configuration Requirements Identical Appliances Hardware Model, Network Interface Modules, Policies, Firmware Version 4 Available Interfaces required (2 port pairs) for each inspected segment Example: Using only the 4x1GB Built-In ports, only 1 segment can be monitored Licensing Each device must have a firmware license, nothing additional is required to use HA Protection Interface Mode must be Inline Supported Modes: Inline Protection and Inline Simulation Monitoring-only mode is unsupported by HA 9

possible HA port group Port Group Configuration Options: Enable High

10 HA Configuration Protection Interfaces Policy Choose the High Availability tab One configuration entry is visible for each possible HA port group Port Group Configuration Options: Enable High Availability mode: Yes / No High Availability Mode: HA Protection / HA Simulation 1

11 HA Configuration Link Propagation Configuration Most networks sense failure using lack of link state and NOT from lack of data flow. In the Protection Interfaces policy, Propagate Link should be set to Yes or Auto for any segment that is using High Availability. Allows the failover controller (switch or firewall) to detect any IPS link state changes. If Propagate Link is set to Auto, this means it will be enabled when configured for an in-line inspection mode. For monitoring mode, it will be disabled. 1

12 HA Configuration Link Propagation (Port Down) 1

13 HA Configuration Link Propagation (FW Controlled Failover) 1

14 HA Implementation - Processing HA Traffic The appliances only block attacks, report events, and generate responses for traffic that occurs on their inline ports The appliances only inspect mirror port traffic and do not block attacks, report events, and generate responses Network statistics are collected for traffic on all ports Only viewable in Local Management Interface (LMI) Flowdata metrics are collected from the traffic on the inline ports only and reported from each device separately Certain attacks such as port scans can generate duplicate event reports due to mirrored traffic. 1

15 ISNP Built-in Bypass

16 Built-in Hardware Bypass Hardware bypass is built physically into the network adapter Eliminates the need for a separate bypass unit appliance Only available on copper and fiber NIMs (not SFP) Configured using the Hardware Bypass option in the Protection Interfaces policy. Auto: If the appliance is a member of an HA pair, then it will Fail Closed. If it is not, then it will fail Open. Fail Open: Allows all network traffic to pass through the appliance. Fail Closed: Closes the links and prevents any traffic from passing through the applaince. Trigger Conditions Hardware failure Power failure Kernel Panic (OS Hang) Sensor process (alpsd) Control Plane crash 1

17 Software Bypass Built into the firmware (handled by packet driver) Allows data to flow without being inspected by the sensor process Configured using the Unanalyzed Policy option in the Protection Interfaces policy Forward: The appliance performs connection tracking if possible. It continues to discard packets that belong to blocked connections. Other packets are transmitted Drop: The appliance discards any packets that cannot be fully analyzed. Trigger Conditions Sensor Stall (inspection is unable to keep up with data flow) Sensor Process (alpsd) Data Plane hang or crash Manual alpsd service restart using the CLI Installing a new XPU or changing an IPS policy can cause the alpsd service to restart resulting in a very short software bypass User can manually stop analysis using CLI command: analysis dpi off (added in release ) 1

18 Bypass Configuration Illustration 1

19 Questions for the panel? Now is your opportunity to ask questions of our panelists. To ask a question now: Press *1 to ask a question over the phone or Type your question into the IBM Connections Cloud Meeting chat To ask a question after this presentation: You are encouraged to participate in our Forum on this topic: 1

com/answers/topics/xgs.html More resources you can review: Technote Network Protection built-in bypass general information at http://www.ibm.

20 Where do you get more information? Questions on this or other topics can be directed to the product forum: IBM dw Answers Forum: Security Network Protection at More resources you can review: Technote Network Protection built-in bypass general information at IBM developerworks articles. IBM Knowledge Center: IBM Security Network Protection at Useful links: How to Contact IBM Software Support for IBM Security IBM Support Portal Sign up for My Notifications Follow us: 2

Statement of Good Security Practices: IT system security involves protecting systems and information through prevention, detection and response to improper access from within and outside your

21 Statement of Good Security Practices: IT system security involves protecting systems and information through prevention, detection and response to improper access from within and outside your enterprise. Improper access can result in information being altered, destroyed, misappropriated or misused or can result in damage to or misuse of your systems, including for use in attacks on others. No IT system or product should be considered completely secure and no single product, service or security measure can be completely effective in preventing improper use or access. IBM systems, products and services are designed to be part of a lawful, comprehensive security approach, which will necessarily involve additional operational procedures, and may require other systems, products or services to be most effective. IBM DOES NOT WARRANT THAT ANY SYSTEMS, PRODUCTS OR SERVICES ARE IMMUNE FROM, OR WILL MAKE YOUR ENTERPRISE IMMUNE FROM, THE MALICIOUS OR ILLEGAL CONDUCT OF ANY PARTY. THANK YOU Copyright IBM Corporation All rights reserved. The information contained in these materials is provided for informational purposes only, and is provided AS IS without warranty of any kind, express or implied. IBM shall not be responsible for any damages arising out of the use of, or otherwise related to, these materials. Nothing contained in these materials is intended to, nor shall have the effect of, creating any warranties or representations from IBM or its suppliers or licensors, or altering the terms and conditions of the applicable license agreement governing the use of IBM software. References in these materials to IBM products, programs, or services do not imply that they will be available in all countries in which IBM operates. Product release dates and / or capabilities referenced in these materials may change at any time at IBM s sole discretion based on market opportunities or other factors, and are not intended to be a commitment to future product or feature availability in any way. IBM, the IBM logo, and other IBM products and services are trademarks of the International Business Machines Corporation, in the United States, other countries or both. Other company, product, or service names may be trademarks or service marks of others.

XGS & QRadar Integration

IBM Security Support Open Mic - January 28, 2015 XGS & QRadar Integration Advanced Threat Protection Integration Options Panelists Wes Davis Advanced Threat Support Group Engineer (Presenter) Thomas Gray