- Title Page
- Introduction & Preface
- Logging into the FireSIGHT System
- Using Objects and Security Zones
- Managing Devices
- Setting Up an IPS Device
- Setting Up Virtual Switches
- Setting Up Virtual Routers
- Setting Up Aggregate Interfaces
- Setting Up Hybrid Interfaces
- Using Gateway VPNs
- Using NAT Policies
- Getting Started with Access Control Policies
- Blacklisting Using Security Intelligence IP Address Reputation
- Tuning Traffic Flow Using Access Control Rules
- Controlling Traffic with Network-Based Rules
- Controlling Traffic with Reputation-Based Rules
- Controlling Traffic Based on Users
- Controlling Traffic Using Intrusion and File Policies
- Understanding Traffic Decryption
- Getting Started with SSL Policies
- Getting Started with SSL Rules
- Tuning Traffic Decryption Using SSL Rules
- Understanding Intrusion and Network Analysis Policies
- Using Layers in Intrusion and Network Analysis Policies
- Customizing Traffic Preprocessing
- Getting Started with Network Analysis Policies
- Using Application Layer Preprocessors
- Configuring SCADA Preprocessing
- Configuring Transport & Network Layer Preprocessing
- Tuning Preprocessing in Passive Deployments
- Getting Started with Intrusion Policies
- Tuning Intrusion Rules
- Tailoring Intrusion Protection to Your Network Assets
- Detecting Specific Threats
- Limiting Intrusion Event Logging
- Understanding and Writing Intrusion Rules
- Blocking Malware and Prohibited Files
- Logging Connections in Network Traffic
- Working with Connection & Security Intelligence Data
- Analyzing Malware and File Activity
- Working with Intrusion Events
- Handling Incidents
- Configuring External Alerting
- Configuring External Alerting for Intrusion Rules
- Introduction to Network Discovery
- Enhancing Network Discovery
- Configuring Active Scanning
- Using the Network Map
- Using Host Profiles
- Working with Discovery Events
- Configuring Correlation Policies and Rules
- Using the FireSIGHT System as a Compliance Tool
- Creating Traffic Profiles
- Configuring Remediations
- Using Dashboards
- Using the Context Explorer
- Working with Reports
- Understanding and Using Workflows
- Using Custom Tables
- Searching for Events
- Managing Users
- Scheduling Tasks
- Managing System Policies
- Configuring Appliance Settings
- Licensing the FireSIGHT System
- Updating System Software
- Monitoring the System
- Using Health Monitoring
- Auditing the System
- Using Backup and Restore
- Specifying User Preferences
- Importing and Exporting Configurations
- Purging Discovery Data from the Database
- Viewing the Status of Long-Running Tasks
- Command Line Reference
- Security, Internet Access, and Communication Ports
- Third-Party Products
- glossary
- Using the Object Manager
- Working with Network Objects
- Working with Security Intelligence Lists and Feeds
Managing Reusable Objects
For increased flexibility and web interface ease-of-use, the FireSIGHT System allows you to create named objects , which are reusable configurations that associate a name with a value so that when you want to use that value, you can use the named object instead.
You can create the following types of objects:
- network-based objects that represent IP addresses and networks, port/protocol pairs, VLAN tags, security zones, and origin/destination country (geolocation)
- reputation-based objects that represent Security intelligence feeds and lists, application filters based on category and reputation, and file lists
- non-reputation-based objects such as URL categories
- intrusion policy variable sets that contain variables you associate with an intrusion policy
- objects that help you handle encrypted traffic, including cipher suites, public key certificates and paired private keys, and certificate distinguished names
You can use these objects in various places in the system’s web interface, including access control policies, network analysis policies, intrusion policies and rules, network discovery rules, event searches, reports, dashboards, and so on.
Grouping objects allows you to reference multiple objects with a single configuration. You can group network, port, VLAN tag, URL, and public key infrastructure (PKI) objects.
Note In most cases, editing an object used in a policy requires a policy reapply for your changes to take effect. Editing a security zone also requires that you reapply the appropriate device configurations.
For more information, see the following sections:
- Using the Object Manager
- Working with Network Objects
- Working with Security Intelligence Lists and Feeds
- Working with Port Objects
- Working with VLAN Tag Objects
- Working with URL Objects
- Working with Application Filters
- Working with Variable Sets
- Working with File Lists
- Working with Security Zones
- Working with Cipher Suite Lists
- Working with Distinguished Name Objects
- Working with PKI Objects
- Working with Geolocation Objects
Using the Object Manager
Create and manage objects, including application filters, variable sets, and security zones, using the object manager ( Objects > Object Management ). You can group network, port, VLAN tag, URL, and PKI objects; you can also sort, filter, and browse the list of objects and object groups.
Grouping Objects
You can group network, port, VLAN tag, URL, and PKI objects. The system allows you to use objects and object groups interchangeably in the web interface. For example, anywhere you would use a port object, you can also use a port object group. Objects and object groups of the same type cannot have the same name.
Tip To group cipher suites, configure a cipher suite list. For more information, see Working with Cipher Suite Lists.
When you edit an object group used in a policy (for example, a network object group used in an access control policy), you must reapply the policy for your changes to take effect.
Deleting a group does not delete the objects in the group, just their association with each other. Additionally, you cannot delete a group that is in use. For example, you cannot delete a VLAN tag group that you are using in a VLAN condition in a saved access control policy.
Access: Admin/Access Admin/Network Admin
Step 1 Select Objects > Object Management .
The Object Management page appears.
Step 2 You have the following options:
The page for the type of object you are grouping appears.
Step 3 Click the Add button that corresponds with the object you want to group.
A pop-up window appears where you can create the group.
Step 4 Type a
Name
for the group. You can use any printable standard ASCII characters except a pipe (
|
) or curly braces (
{}
).
Step 5 Select one or more objects and click Add .
to search for existing objects to include, which updates as you type to display matching items. Click the reload icon 
above the search field or click the clear icon (
) in the search field to clear the search string. 
] to create objects on the fly if no existing objects meet your needs.Browsing, Sorting, and Filtering Objects
The object manager displays 20 objects or groups per page. If you have more than 20 of any type of object or group, use the navigation links at the bottom of the page to view additional pages. You can also go to a specific page or click the refresh icon (
) to refresh your view.
By default, the page lists objects and groups alphabetically by name. However, you can sort each type of object or group by any column in the display. An up (
) or down (
) arrow next to a column heading indicates that the page is sorted by that column in that direction. You can also filter the objects on the page by name. For some object types, the same filter will match on either the name or the value.
Access: Admin/Access Admin/Network Admin
Step 1 Click a column heading. To sort in the opposite direction, click the heading again.
Access: Admin/Access Admin/Network Admin
Step 1 Type your filter criteria in the Filter field.
The page updates as you type to display matching items. You can use the following metacharacters:
Working with Network Objects
A network object represents one or more IP addresses that you can specify either individually or as address blocks. You can use network objects and groups (see Grouping Objects) in various places in the system’s web interface, including access control policies, network variables, intrusion rules, network discovery rules, event searches, reports, and so on.
You also cannot delete a network object that is in use. Additionally, after you edit a network object used in an access control, network discovery, or intrusion policy, you must reapply the policy for your changes to take effect.
Access: Admin/Access Admin/Network Admin
Step 1 Select Objects > Object Management .
The Object Management page appears.
Step 2 Under Network , select Individual Objects .
The Network Objects pop-up window appears.
Step 4 Type a
Name
for the network object. You can use any printable standard ASCII characters except a pipe (
|
) or curly braces (
{}
).
Step 5 For each IP address or address block you want to add to the network object, type its value and click Add .
Working with Security Intelligence Lists and Feeds
Supported Devices: Any except Series 2
Supported Defense Centers: Any except DC500
The Security Intelligence feature allows you to, per access control policy, specify the traffic that can traverse your network based on the source or destination IP address. This is especially useful if you want to blacklist — deny traffic to and from — specific IP addresses, before the traffic is subjected to analysis by access control rules. Similarly, you can add IP addresses to the whitelist to force the system to handle their connections using access control.
If you are not sure whether you want to blacklist a particular IP address, you can use a “monitor-only” setting, which allows the system to handle the connection using access control, but also logs the connection’s match to the blacklist.
A global whitelist and global blacklist are included by default in every access control policy, and apply to any zone. Additionally, within each access control policy, you can build a separate whitelist and blacklist using a combination of network objects and groups as well as Security Intelligence lists and feeds, all of which you can constrain by security zone.
Note Although they have all other Protection capabilities by default, Series 2 devices cannot perform Security Intelligence filtering.
A Security Intelligence feed is a dynamic collection of IP addresses that the Defense Center downloads from an HTTP or HTTPS server at the interval you configure. Because feeds are regularly updated, the system can use up-to-date information to filter your network traffic. To help you build blacklists, Cisco provides the Intelligence Feed (sometimes called the Sourcefire Intelligence Feed ), which represents IP addresses determined by the Cisco VRT to have a poor reputation.
When the Defense Center downloads updated feed information, it automatically updates its managed devices. Although it may take a few minutes for a feed update to take effect throughout your deployment, you do not have to reapply access control policies after you create or modify a feed, or after a scheduled feed update.
Note If you want strict control over when the Defense Center downloads a feed from the Internet, you can disable automatic updates for that feed. However, Cisco recommends that you allow automatic updates. Although you can manually perform on-demand updates, allowing the system to download feeds on a regular basis provides you with the most up-to-date, relevant data.
A Security Intelligence list , contrasted with a feed, is a simple static list of IP addresses that you manually upload to the Defense Center. Use custom lists to augment and fine-tune feeds and the global whitelist and blacklist. Note that editing custom lists (as well as editing network objects and removing IP addresses from the global whitelist or blacklist) require an access control policy apply for your changes to take effect.
Formatting and Corrupt Feed Data
Feed and list source must be a simple text file no larger than 500MB, with one IP address or address block per line. Comment lines must start with the
#
character. List source files must use the
.txt
extension.
If the Defense Center downloads a corrupt feed or a feed with no recognizable IP addresses, the system continues using the old feed data (unless it is the first download). However, if the system can recognize even one IP address in the feed, the Defense Center updates its managed devices with the addresses it can recognize.
The default health policy includes the Security Intelligence module, which alerts in a few situations involving Security Intelligence filtering, including if the Defense Center cannot update a feed, or if a feed is corrupt or contains no recognizable IP addresses.
Internet Access and High Availability
The system uses port 443/HTTPS to download the Intelligence Feed, and either 443/HTTP or 80/HTTP to download custom or third-party feeds. To update feeds, you must open the appropriate port, both inbound and outbound, on the Defense Center. If your Defense Center does not have direct access to the feed site, it can use a proxy server (see Configuring Management Interfaces).
Note The Defense Center does not perform peer SSL certificate verification when downloading custom feeds, nor does the system support the use of certificate bundles or self-signed certificates to verify the remote peer.
Although Security Intelligence objects are synchronized between Defense Centers in a high availability deployment, only the primary Defense Center downloads feed updates. If the primary Defense Center fails, you must not only make sure that the secondary Defense Center has access to the feed sites, but also use the web interface on the secondary Defense Center to promote it to
Active
. For more information, see Monitoring and Changing High Availability Status.
You create and manage Security Intelligence lists and feeds, collectively called Security Intelligence objects, using the object manager’s Security Intelligence page. (For information on creating and managing network objects and groups, see Working with Network Objects.)
Note that you cannot delete a custom list or feed that is currently being used in a saved or applied access control policy. You also cannot delete a global list, although you can remove individual IP addresses. Similarly, although you cannot delete the Intelligence Feed, editing it allows you to disable or change the frequency of its updates.
Security Intelligence Object Quick Reference
The following table provides a quick reference to the objects you can use to perform Security Intelligence filtering.
For more information on creating, managing, and using Security Intelligence lists and feeds, see:
- Working with the Global Whitelist and Blacklist
- Working with the Intelligence Feed
- Working with Custom Security Intelligence Feeds
- Manually Updating Security Intelligence Feeds
- Working with Custom Security Intelligence Lists
- Blacklisting Using Security Intelligence IP Address Reputation
Working with the Global Whitelist and Blacklist
Supported Devices: Any except Series 2
Supported Defense Centers: Any except DC500
In the course of your analysis, you can build a Security Intelligence global blacklist by using the IP address context menu in an event view, the Context Explorer, or a dashboard. For example, if you notice a set of routable IP addresses in intrusion events associated with exploit attempts, you can immediately blacklist those IP addresses. You can also build a global whitelist in a similar fashion.
The system’s global whitelist and blacklist are included by default in every access control policy, and apply to any zone. You can opt not to use these global lists on a per-policy basis.
When you add an IP address to a global list, the Defense Center automatically updates its managed devices. Although it may take a few minutes for your changes to take effect throughout your deployment, you do not have to reapply access control policies after adding an IP address to a global list. Conversely, after you delete IP addresses from the global whitelist or blacklist, you must apply your access control policies for your changes to take effect.
Note that although you can add network objects with a netmask of /0 to the whitelist or blacklist, address blocks using a
/0
netmask in those objects will be ignored and whitelist and blacklist filtering will not occur based on those addresses. Address blocks with a
/0
netmask from Security Intelligence feeds will also be ignored. If you want to monitor or block all traffic targeted by a policy, use an access control rule with the
Monitor
or
Block
rule action, respectively, and a default value of
any
for the
Source Networks
and
Destination Networks
, instead of security intelligence filtering.
Because adding an IP address to the global whitelist or blacklist affects access control, you must have one of the following:
- Administrator access
- a combination of default roles: Network Admin or Access Admin, plus Security Analyst and Security Approver
- a custom role with both Modify Access Control Policy and Apply Access Control Policy permissions; see Managing Your Deployment with Custom User Roles
To add an IP address to the global whitelist or blacklist using the context menu:
Step 1 In an event view, packet view, the Context Explorer, or a dashboard, hover your pointer over an IP address hotspot.
Tip In an event view or dashboard, hover your pointer over an IP address, not the host icon (
) to its left.
Step 2 Invoke the context menu:
Step 3 From the context menu, select either Whitelist Now or Blacklist Now .
For information on the other options in the context menu, see Using the Context Menu.
Step 4 Confirm that you want to whitelist or blacklist the IP address.
After the Defense Center communicates your addition to its managed devices, your deployment begins filtering traffic according to your change.
To remove IP addresses from the global whitelist or blacklist:
Step 1 On the object manager’s Security Intelligence page, next to the global whitelist or blacklist, click the edit icon (
).
The Global Whitelist or Global Blacklist pop-up window appears.
Step 2 Next to the IP addresses you want to remove from the list, click the delete icon (
).
To delete multiple IP addresses at once, use the Shift and Ctrl keys to select them, then right-click and select Delete .
Your changes are saved, but you must apply your access control policies for them to take effect
Working with the Intelligence Feed
Supported Devices: Any except Series 2
Supported Defense Centers: Any except DC500
To help you build blacklists, Cisco provides the Intelligence Feed (sometimes called the Sourcefire Intelligence Feed ), which is comprised of several regularly updated lists of IP addresses determined by the VRT to have a poor reputation. Each list in the Intelligence Feed represents a specific category: open relays, known attackers, bogus IP addresses (bogon), and so on. In an access control policy, you can blacklist any or all of the categories.
Because the Intelligence Feed is regularly updated, the system can use up-to-date information to filter your network traffic. Malicious IP addresses that represent security threats such as malware, spam, botnets, and phishing may appear and disappear faster than you can update and apply new policies.
Although you cannot delete the Intelligence Feed, editing it allows you to change the frequency of its updates. By default, the feed updates every two hours.
To modify the Intelligence Feed’s update frequency:
Step 1 On the object manager’s Security Intelligence page, next to the Sourcefire Intelligence Feed, click the edit icon (
).
The Sourcefire Security Intelligence pop-up window appears.
Step 2 Edit the Update Frequency .
You can select from various intervals from two hours to one week. You can also disable feed updates.
Working with Custom Security Intelligence Feeds
Supported Devices: Any except Series 2
Supported Defense Centers: Any except DC500
Custom or third-party Security Intelligence feeds allow you to augment the Intelligence Feed with other regularly-updated reputable whitelists and blacklists on the Internet. You can also set up an internal feed, which is useful if you want to update multiple Defense Centers in your deployment using one source list.
When you configure a feed, you specify its location using a URL; the URL cannot be Punycode-encoded. By default, the Defense Center downloads the entire feed source on the interval you configure, then automatically updates its managed devices.
Optionally, you can configure the system to use an md5 checksum to determine whether to download an updated feed. If the checksum has not changed since the last time the Defense Center downloaded the feed, the system does not need to re-download it. You may want to use md5 checksums for internal feeds, especially if they are large. The md5 checksum must be stored in a simple text file with only the checksum. Comments are not supported.
To configure a Security Intelligence feed:
Step 1 On the object manager’s Security Intelligence page, click Add Security Intelligence .
The Security Intelligence pop-up window appears.
Step 2 Type a
Name
for the feed. You can use any printable standard ASCII characters except a pipe (
|
) or curly braces (
{}
).
Step 3 From the Type drop-down list, specify that you want to configure a Feed .
The pop-up window updates with new options.
Step 4 Specify a Feed URL and optionally, an MD5 URL .
Step 5 Select an Update Frequency .
You can select from various intervals from two hours to one week. You can also disable feed updates.
The Security Intelligence feed object is created. Unless you disabled feed updates, the Defense Center attempts to download and verify the feed. You can now use the feed object in access control policies.
Manually Updating Security Intelligence Feeds
Supported Devices: Any except Series 2
Supported Defense Centers: Any except DC500
Manually updating Security Intelligence feeds updates all feeds, including the Intelligence Feed.
To update all Security Intelligence feeds:
Access: Admin/Access Admin/Network Admin
Step 1 On the object manager’s Security Intelligence page, click Update Feeds .
Step 2 Confirm that you want to update all feeds.
A confirmation dialog appears, warning you that it can take several minutes for the update to take effect.
After the Defense Center downloads and verifies the feed updates, it communicates any changes to its managed devices. Your deployment begins filtering traffic using the updated feeds.
Working with Custom Security Intelligence Lists
Supported Devices: Any except Series 2
Supported Defense Centers: Any except DC500
A Security Intelligence list is a simple static list of IP addresses and address blocks that you manually upload to the Defense Center. Custom lists are useful if you want to augment and fine-tune feeds or one of the global lists, for a single Defense Center’s managed devices.
Note that netmasks for address blocks can be integers from
0
to
32
or
0
to
128,
for IPv4 and IPv6, respectively.
For example, if a reputable feed improperly blocks your access to vital resources but is overall useful to your organization, you can create a custom whitelist that contains only the improperly classified IP addresses, rather than removing the Security Intelligence feed object from the access control policy’s blacklist.
Note that to modify a Security Intelligence list, you must make your changes to the source file and upload a new copy. For more information, see Updating a Security Intelligence List.
To upload a new Security Intelligence list to the Defense Center:
Access: Admin/Access Admin/Network Admin
Step 1 On the object manager’s Security Intelligence page, click Add Security Intelligence .
The Security Intelligence pop-up window appears.
Step 2 Type a
Name
for the list. You can use any printable standard ASCII characters except a pipe (
|
) or curly braces (
{}
).
Step 3 From the Type drop-down list, specify that you want to upload a List .
The pop-up window updates with new options.
Step 4 Click
Browse
to browse to the list
.txt
file, then click Upload.
The list is uploaded. The pop-up window displays the total number of IP addresses and address blocks that the system found in the list.
If the number is not what you expected, check the formatting of the file and try again.
The Security Intelligence list object is saved. You can now use it in access control policies.
Updating a Security Intelligence List
Supported Devices: Any except Series 2
Supported Defense Centers: Any except DC500
To edit a Security Intelligence list, you must make your changes to the source file and upload a new copy. You cannot modify the file’s contents using the Defense Center web interface. If you do not have access to the source file, you can download a copy from the Defense Center.
To modify a Security Intelligence list:
Access: Admin/Access Admin/Network Admin
Step 1 On the object manager’s Security Intelligence page, next to the list you want to update, click the edit icon (
).
The Security Intelligence pop-up window appears.
Step 2 If you need a copy of the list to edit, click Download , then follow your browser’s prompts to save the list as a text file.
Step 3 Make changes to the list as necessary.
Step 4 On the Security Intelligence pop-up window, click Browse to browse to the modified list, then click Upload .
Your changes are saved. If the list is being used by an active access control policy, you must apply the policy for your changes to take effect.
Working with Port Objects
Port objects represent different protocols in slightly different ways:
-
For TCP and UDP, a port object represents the transport layer protocol, with the protocol number in parentheses, plus an optional associated port or port range. For example:
TCP(6)/22. -
For ICMP and ICMPv6 (IPv6-ICMP), the port object represents the Internet layer protocol plus an optional type and code. For example:
ICMP(1):3:3. - A port object can also represent other protocols that do not use ports.
Note that Cisco provides default port objects for well-known ports. You can modify or delete these objects, but Cisco recommends that you create custom port objects instead.
You can use port objects and groups (see Grouping Objects) in various places in the system’s web interface, including access control policies, network discovery rules, port variables, and event searches. For example, if your organization uses a custom client that uses a specific range of ports and causes the system to generate excessive and misleading events, you can configure your network discovery policy to exclude monitoring those ports.
You cannot delete a port object that is in use. Additionally, after you edit a port object used in an access control or network discovery policy, you must reapply the policy for your changes to take effect.
Note that you cannot add any protocol other than TCP or UDP for source port conditions in access control rules. Also, you cannot mix transport protocols when setting both source and destination port conditions in a rule.
If you add an unsupported protocol to a port object group used in a source port condition, the rule where it is used does not apply to the managed device on policy apply. Additionally, if you create a port object containing both TCP and UDP ports, then add it as a source port condition in a rule, you cannot add a destination port, and vice versa.
Access: Admin/Access Admin/Network Admin
Step 1 Select Objects > Object Management .
The Object Management page appears.
Step 2 Under Port , select Individual Objects .
The Port Objects pop-up window appears.
Step 4 Type a
Name
for the port object. You can use any printable standard ASCII characters except a pipe (
|
) or curly braces (
{}
).
You can quickly select TCP , UDP , IP , ICMP , or IPv6-ICMP , or you can use the Other drop-down list to select either a different protocol or All protocols.
Step 6 Optionally, restrict a TCP or UDP port object using a Port or port range.
You can specify any port from 1 to 65535 or
any
to match all ports. Use a hyphen to specify a range of ports.
Step 7 Optionally, restrict an ICMP or IPV6-ICMP port object using a Type and, if appropriate, a related Code .
When you create an ICMP or IPv6-ICMP object, you can specify the type and, if applicable, the code. For more information on ICMP types and codes, see:
- http://www.iana.org/assignments/icmp-parameters/icmp-parameters.xml
- http://www.iana.org/assignments/icmpv6-parameters/icmpv6-parameters.xml
You can set the type to any to match any type or set the code to any to match any code for the specified type.
Step 8 Optionally, select Other and a protocol from the drop-down list. If you select All protocols, type a port number in the Port field.
Working with VLAN Tag Objects
Each VLAN tag object you configure represents a VLAN tag or range of tags. You can use VLAN tag objects and groups (see Grouping Objects) in various places in the system’s web interface, including access control policies and event searches. For example, you could write an access control rule that applies only to a specific VLAN.
You cannot delete a VLAN tag object that is in use. Additionally, after you edit a VLAN tag object used in an access control policy, you must reapply the policy for your changes to take effect.
Access: Admin/Access Admin/Network Admin
Step 1 Select Objects > Object Management .
The Object Management page appears.
Step 2 Under VLAN Tag , select Individual Objects .
The VLAN Tag pop-up window appears.
Step 4 Type a
Name
for the VLAN tag. You can use any printable standard ASCII characters except a pipe (
|
) or curly braces (
{}
).
Step 5 In the VLAN Tag field, type a value for the VLAN tag.
You can specify any VLAN tag from 1 to 4094. Use a hyphen to specify a range of VLAN tags.
Working with URL Objects
Supported Devices: Any except Series 2
Supported Defense Centers: Any except DC500
Each URL object you configure represents a single URL or IP address. You can use URL objects and groups (see Grouping Objects) in various places in the system’s web interface, including access control policies and event searches. For example, you could write an access control rule that blocks a specific website.
When creating URL objects, especially if you do not configure SSL inspection to decrypt or block encrypted traffic, keep the following points in mind:
- If you plan to use a URL object to match HTTPS traffic in an access control rule, create the object using the subject common name in the public key certificate used to encrypt the traffic. Also, the system disregards subdomains within the subject common name, so do not include subdomain information. For example, use example.com rather than www.example.com.
-
When matching web traffic using access control rules with URL conditions, the system disregards the encryption protocol (HTTP vs HTTPS). In other words, if you block a website, both HTTP and HTTPS traffic to that website is blocked, unless you use an application condition to refine the rule. When creating a URL object, you do not need to specify the protocol when creating an object. For example, use
example.comrather thanhttp://example.com/.
For more information, see Understanding Traffic Decryption and Blocking URLs.
You cannot delete a URL object that is in use. Additionally, after you edit a URL object used in an access control policy, you must reapply the policy for your changes to take effect.
Access: Admin/Access Admin/Network Admin
Step 1 Select Objects > Object Management .
The Object Management page appears.
Step 2 Under URL , select Individual Objects .
The URL Objects pop-up window appears.
Step 4 Type a
Name
for the URL object. You can use any printable standard ASCII characters except a pipe (
|
) or curly braces (
{}
).
Step 5 Type the
URL
or IP address for the URL object. You
cannot
use wildcards (
*
) in this field.
Working with Application Filters
Supported Devices: Any except Series 2
When the FireSIGHT System analyzes IP traffic, it attempts to identify the commonly used applications on your network. Application awareness is crucial to performing application-based access control. The system is delivered with detectors for many applications, and Cisco frequently updates and adds additional detectors via system and vulnerability database (VDB) updates. You can also create your own application protocol detectors to enhance the system’s detection capabilities.
Application filters group applications according to criteria associated with the applications’ risk, business relevance, type, categories, and tags; see Table 45-2. When you create an application protocol detector, you must characterize the application using those criteria as well. Using application filters allows you to quickly create application conditions for access control rules because you do not have to search for and add applications individually; for more information, see Matching Traffic with Application Filters.
Another advantage to using application filters is that you do not have to update access control rules that use filters when you modify or add new applications. For example, if you configure your access control policy to block all social networking applications, and a VDB update includes a new social networking application detector, the policy is updated when you update the VDB. Although you must reapply the policy before the system can block the new application, you do not have to update the access control rule that blocks the application.
If the Cisco-provided application filters do not group applications according to your needs, you can create your own filters. User-defined filters can group and combine Cisco-provided filters. For example, you could create a filter that would allow you to block all very high risk, low business relevance applications. You can also create a filter by manually specifying individual applications, although you should keep in mind those filters do not automatically update when you update the system software or the VDB.
As with Cisco-provided application filters, you can use user-defined application filters in access control rules. You can also use user-defined filters in the following additional ways:
- To search for applications using the event viewer; see Using Objects and Application Filters in Searches
- To constrain a table view in a report template; see Working with Searches in Report Template Sections
- To filter application statistics in a Custom Analysis dashboard widget; see Configuring the Custom Analysis Widget
You use the object manager ( Objects > Object Management ) to create and manage application filters. Note that you can also create an application filter on the fly while adding an application condition to an access control rule.
The Application Filters list contains the Cisco-provided application filters that you can select to build your own filter. You can constrain the filters that appear by using a search string; this is especially useful for categories and tags.
The Available Applications list contains the individual applications in the filters you select. You can also constrain the applications that appear by using a search string.
The system links multiple filters of the same filter type with an OR operation. Consider a scenario where the medium risk filter contains 100 applications and the high risk filter contains 50 applications. If you select both filters, the system would display 150 available applications.
The system links different types of filters with an AND operation. For example, if you select the medium and high risk filters and the medium and high business relevance filters, the system displays the applications that have medium or high risk, and also have medium or high business relevance.
Tip Click an information icon (
) for more information about the associated application. To display additional information, click any of the Internet search links in the pop-up that appears.
After you determine the applications you want to add to the filter, you can add them either individually, or, if you selected an application filter, All apps matching the filter . You can add multiple filters and multiple applications, in any combination, as long as the total number of items in the Selected Applications and Filters list does not exceed 50.
After you create the application filter, it is listed on the Application Filters page of the object manager. The page displays the total number of conditions that comprise each filter.
For information on sorting and filtering the application filters that appear, see Using the Object Manager. Note that you cannot delete an application filter that is in use. Additionally, after you edit an application filter used in an access control policy, you must reapply the policy for your changes to take effect.
To create an application filter:
Access: Admin/Access Admin/Network Admin
Step 1 Select Objects > Object Management .
The Object Management page appears.
Step 2 Click Application Filters .
The Application Filters section appears.
Step 3 Click Add Application Filter .
The Application Filter pop-up window appears.
Step 4 Give the filter a
Name
. You can use any printable standard ASCII characters except a pipe (
|
) or curly braces (
{}
).
Step 5 Optionally, use Cisco-provided filters in the Application Filters list to narrow the list of applications you want to add to the filter:
- Click the arrow next to each filter type to expand and collapse the list.
- Right-click a filter type and click Check All or Uncheck All . Note that the list indicates how many filters you have selected of each type.
- To narrow the filters that appear, type a search string in the Search by name field; this is especially useful for categories and tags. To clear the search, click the clear icon —
.
).The applications that match the filters you select appear in the Available Applications list. The list displays 100 applications at a time.
Step 6 Select the applications that you want to add to the filter from the Available Applications list:
- Select All apps matching the filter to add all the applications that meet the constraints you specified in the previous step.
- To narrow the individual applications that appear, type a search string in the Search by name field. To clear the search, click the clear icon (
).- Use the paging icons at the bottom of the list to browse the list of individual available applications.
- Use Shift and Ctrl keys to select multiple individual applications. Right-click to Select All currently displayed individual applications.
- To refresh the applications list and clear any selected applications, click the reload icon (
).You cannot select individual applications and All apps matching the filter at the same time.
Step 7 Add the selected applications to the filter. You can click and drag, or you can click Add to Rule .
The result is the combination of:
You can add up to 50 applications and filters to the filter. To delete an application or filter from the selected applications, click the appropriate delete icon (
). You can also select one or more applications and filters, or right click to
Select All
, then right-click to
Delete Selected
.
The application filter is saved.
Working with Variable Sets
Variables represent values commonly used in intrusion rules to identify source and destination IP addresses and ports. You can also use variables in intrusion policies to represent IP addresses in rule suppressions, adaptive profiles, and dynamic rule states.
Tip Preprocessor rules can trigger events regardless of the hosts defined by network variables used in intrusion rules.
You use variable sets to manage, customize, and group your variables. You can use the default variable set provided by Cisco or create your own custom sets. Within any set you can modify predefined default variables and add and modify user-defined variables.
Most of the shared object rules and standard text rules that the FireSIGHT System provides use predefined default variables to define networks and port numbers. For example, the majority of the rules use the variable
$HOME_NET
to specify the protected network and the variable
$EXTERNAL_NET
to specify the unprotected (or outside) network. In addition, specialized rules often use other predefined variables. For example, rules that detect exploits against web servers use the
$HTTP_SERVERS
and
$HTTP_PORTS
variables.
Rules are more effective when variables more accurately reflect your network environment. At a minimum, you should modify default variables in the default set as described in Optimizing Predefined Default Variables. By ensuring that a variable such as
$HOME_NET
correctly defines your network and
$HTTP_SERVERS
includes all web servers on your network, processing is optimized and all relevant systems are monitored for suspicious activity.
To use your variables, you link variable sets to intrusion policies associated with access control rules or with the default action of an access control policy. By default, the default variable set is linked to all intrusion policies used by access control policies.
See the following sections for more information:
- Optimizing Predefined Default Variables
- Understanding Variable Sets
- Managing Variable Sets
- Managing Variables
- Adding and Editing Variables
- Resetting Variables
- Nesting Variables
- Linking Variable Sets to Intrusion Policies
- Understanding Advanced Variables
Optimizing Predefined Default Variables
By default, the FireSIGHT System provides a single default variable set, which is comprised of predefined default variables. The Cisco Vulnerability Research Team (VRT) uses rule updates to provide new and updated intrusion rules and other intrusion policy elements, including default variables. See Importing Rule Updates and Local Rule Files for more information.
Because many intrusion rules provided by Cisco use predefined default variables, you should set appropriate values for these variables. Depending on how you use variable sets to identify traffic on your network, you can modify the values for these default variables in any or all variable sets. See Adding and Editing Variables for more information.
Caution Importing an access control or an intrusion policy overwrites existing default variables in the default variable set with the imported default variables. If your existing default variable set contains a custom variable not present in the imported default variable set, the unique variable is preserved. For more information, see Importing Configurations.
The following table describes the variables provided by Cisco and indicates which variables you typically would modify. For assistance determining how to tailor variables to your network, contact Professional Services or Support.
Defines known AOL Instant Messenger (AIM) servers, and is used in chat-based rules and rules that look for AIM exploits. |
||
Defines Domain Name Service (DNS) servers. If you create a rule that affects DNS servers specifically, you can use the |
||
Defines the network that the FireSIGHT System views as the unprotected network, and is used in many rules to define the external network. |
Yes, you should adequately define |
|
Defines non-encrypted ports used in intrusion rules that detect files in a network stream. |
||
Defines the ports of FTP servers on your network, and is used for FTP server exploit rules. |
Yes, if your FTP servers use ports other than the default ports (you can view the default ports in the web interface). |
|
Defines the data channel ports where the packet decoder extracts the payload inside a GTP (General Packet Radio Service [GPRS] Tunneling Protocol) PDU. |
||
Defines the network that the associated intrusion policy monitors, and is used in many rules to define the internal network. |
||
Defines the ports of web servers on your network, and is used for web server exploit rules. |
Yes, if your web servers use ports other than the default ports (you can view the default ports in the web interface). |
|
Defines the web servers on your network. Used in web server exploit rules. |
||
Defines Oracle database server ports on your network, and is used in rules that scan for attacks on Oracle databases. |
||
Defines the ports you want the system to scan for shell code exploits, and is used in rules that detect exploits that use shell code. |
||
Defines the ports of SIP servers on your network, and is used for SIP exploit rules. |
||
Defines SIP servers on your network, and is used in rules that address SIP-targeted exploits. |
Yes, if you run SIP servers, you should adequately define |
|
Defines SMTP servers on your network, and is used in rules that address exploits that target mail servers. |
||
Defines SNMP servers on your network, and is used in rules that scan for attacks on SNMP servers. |
||
Identifies a legacy advanced variable that appears only when it existed on your system in a FireSIGHT System software release before Version 5.3.0 that you subsequently upgraded to Version 5.3.0 or greater. See Understanding Advanced Variables. |
No, you can only view or delete this variable. You cannot edit it or recover it after deleting it. |
|
Defines database servers on your network, and is used in rules that address database-targeted exploits. |
||
Defines the ports of SSH servers on your network, and is used for SSH server exploit rules. |
Yes, if your SSH servers use ports other than the default port (you can view the default ports in the web interface). |
|
Defines SSH servers on your network, and is used in rules that address SSH-targeted exploits. |
Yes, if you run SSH servers, you should adequately define |
|
Defines known Telnet servers on your network, and is used in rules that address Telnet server-targeted exploits. |
||
Provides a general tool that allows you to configure one or more features not otherwise available via the web interface. See Understanding Advanced Variables.
Caution Conflicting or duplicate
$USER_CONF configurations will halt the system. See Understanding Advanced Variables. |
No, only as instructed in a feature description or with the guidance of Support. |
Understanding Variable Sets
Adding a variable to any set adds it to all sets; that is, each variable set is a collection of all variables currently configured on your system. Within any variable set, you can add user-defined variables and customize the value of any variable.
Initially, the FireSIGHT System provides a single, default variable set comprised of predefined default values. Each variable in the default set is initially set to its default value, which for a predefined variable is the value set by the VRT and provided in rule updates.
Although you can leave predefined default variables configured to their default values, Cisco recommends that you modify a subset of predefined variables as described in Optimizing Predefined Default Variables.
You could work with variables only in the default set, but in many cases you can benefit most by adding one or more custom sets, configuring different variable values in different sets, and perhaps even adding new variables.
When using multiple sets, it is important to remember that the current value of any variable in the default set determines the default value of the variable in all other sets.
Example: Adding a User-Defined Variable to the Default Set
The following diagram illustrates set interactions when you add the user-defined variable
Var1
to the default set with the value
192.168.1.0/24
.
Optionally, you can customize the value of
Var1
in any set. In Custom Set 2 where
Var1
has not been customized, its value is
192.168.1.0/24
. In Custom Set 1 the customized value
192.168.2.0/24
of
Var1
overrides the default value. Resetting a user-defined variable in the default set resets its default value to
any
in all sets.
It is important to note in this example that, if you do not update
Var1
in Custom Set 2, further customizing or resetting
Var1
in the default set consequently updates the current, default value of
Var1
in Custom Set 2, thereby affecting any intrusion policy linked to the variable set.
Although not shown in the example, note that interactions between sets are the same for user-defined variables and default variables except that resetting a default variable in the default set resets it to the value configured by Cisco in the current rule update.
Examples: Adding a User-Defined Variable to a Custom Set
The next two examples illustrate variable set interactions when you add a user-defined variable to a custom set. When you save the new variable, you are prompted whether to use the configured value as the default value for other sets. In the following example, you elect to use the configured value.
Note that, except for the origin of
Var1
from Custom Set 1, this example is identical to the example above where you added
Var1
to the default set. Adding the customized value
192.168.1.0/24
for
Var1
to Custom Set 1 copies the value to the default set as a customized value with a default value of
any
. Thereafter,
Var1
values and interactions are the same as if you had added
Var1
to the default set. As with the previous example, keep in mind that further customizing or resetting
Var1
in the default set consequently updates the current, default value of
Var1
in Custom Set 2, thereby affecting any intrusion policy linked to the variable set.
In the next example, you add
Var1
with the value 192.168.1.0/24 to Custom Set 1 as in the previous example, but you elect
not to use
the configured value of
Var1
as the default value in other sets.
This approach adds
Var1
to all sets with a default value of
any
. After adding
Var1,
you can customize its value in any set. An advantage of this approach is that, by not initially customizing
Var1
in the default set, you decrease your risk of customizing the value in the default set and thus inadvertently changing the current value in a set such as Custom Set 2 where you have not customized
Var1
.
Managing Variable Sets
When you select Variable Sets on the Object Manager page ( Objects > Object Management ), the object manager lists the default variable set and any custom sets you created.
On a freshly installed system, the default variable set is comprised only of the default variables predefined by Cisco.
Each variable set includes the default variables provided by Cisco and all custom variables you have added from any variable set. Note that you can edit the default set, but you cannot rename or delete the default set.
Caution Importing an access control or an intrusion policy overwrites existing default variables in the default variable set with the imported default variables. If your existing default variable set contains a custom variable not present in the imported default variable set, the unique variable is preserved. For more information, see Importing Configurations.
The following table summarizes the actions you can take to manage your variable sets.
) in the filter field.After you configure variable sets, you can link them to intrusion policies.
To create or edit a variable set:
Access: Admin/Access Admin/Network Admin
Step 1 Select Objects > Object Management .
The Object Management page appears.
Step 3 Add a variable set or edit an existing set:
) next to the variable set.
The new or edit variable set page appears. When naming a variable set, you can use any printable standard ASCII characters except a pipe (
|
) or curly braces (
{}
). See Adding and Editing Variables for information on adding and editing variables within a variable set.
Managing Variables
You manage variables on the new or edit variables page within a variable set. The variables page for all variable sets separates variables into Customized Variables and Default Variables page areas.
A default variable is a variable provided by Cisco. You can customize the value of a default variable. You cannot rename or delete a default variable, and you cannot change its default value.
A customized variable is one of the following:
When you edit the value for a default variable, the system moves the variable from the Default Variables area to the Customized Variables area. Because variable values in the default set determine the default values of variables in custom sets, customizing a default variable in the default set modifies the default value of the variable in all other sets.
You can add and delete your own variables, customize their values within different variable sets, and reset customized variables to their default values. When you reset a user-defined variable, it remains in the Customized Variables area.
The following table summarizes the actions you can take to create or edit variables.
on the variable sets page, click
Add Variable Set
to create a new variable set, or click the edit icon ( |
|
enter an alphanumeric string including spaces and special characters in the Name and Description fields. Note Variable set names can use any printable standard ASCII characters except a pipe ( |
|
hover your pointer over the value in the Value column next to the variable. Note A variable value can include up to 8192 characters. Keep in mind, however, that this limit applies to the size of the expanded value of the variable. If you use one or more variables to define another variable, the total number of characters and spaces of all the variable values cannot exceed 8192 characters. |
|
|
See Adding and Editing Variables for more information. |
|
click the edit icon ( See Adding and Editing Variables for more information. |
|
click the reset icon ( |
|
click the delete icon ( You cannot delete default variables, and you cannot delete user-defined variables that are used by intrusion rules or other variables. |
|
click Save , then click Yes if the variable set is in use by an access control policy to confirm that you want to save your changes. Because the current value in the default set determines the default value in all other sets, modifying or resetting a variable in the default set changes the current value in other sets where you have not customized the default value. |
To view the variables in a variable set:
Access: Admin/Access Admin/Network Admin
Step 1 Select Objects > Object Management .
The Object Management page appears.
Step 3 Add a variable set or edit an existing set:
) next to the variable set.
The new or edit variable set page appears. When naming a variable set, you can use any printable standard ASCII characters except a pipe (
|
) or curly braces (
{}
).
Step 4 Add a variable or edit an existing variable:
) next to the variable.The new or edit variable page appears.
See Adding and Editing Variables for information on adding and editing variables within a variable set.
Adding and Editing Variables
You can modify variables in any custom set.
If you create custom standard text rules, you might also want to add your own user-defined variables to more accurately reflect your traffic or as shortcuts to simplify the rule creation process. For example, if you create a rule that you want to inspect traffic in the “demilitarized zone” (or DMZ) only, you can create a variable named
$DMZ
whose value lists the server IP addresses that are exposed. You can then use the
$DMZ
variable in any rule written for this zone.
Adding a variable to a variable set adds it to all other sets. With one exception as explained below, the variable is added to other sets as the default value, which you can then customize.
When you add a variable from a custom set, you must choose whether to use the configured value as the customized value in the default set.
-
If you
do use
the configured value (for example, 192.168.0.0/16), the variable is added to the default set using the configured value as a customized value with a default value of
any. Because the current value in the default set determines the default value in other sets, the initial, default value in other custom sets is the configured value (which in the example is 192.168.0.0/16). -
If you
do not use
the configured value, the variable is added to the default set using only the default value
anyand, consequently, the initial, default value in other custom sets isany.
See Understanding Variable Sets for more information.
You add variables within a variable set on the New Variable page and edit existing variables on the Edit Variable page. You use the two pages identically except that when you edit an existing variable you cannot change the variable name or variable type.
Each page consists mainly of three windows:
- available items, including existing network or port variables, objects, and network object groups
- networks or ports to include in the variable definition
- networks or ports to exclude from the variable definition
You can create or edit two types of variables:
- network variables specify the IP addresses of hosts in your network traffic. See Working with Network Variables.
-
port
variables specify TCP or UDP ports in network traffic, including the value
anyfor either type. See Working with Port Variables.
When you specify whether you want to add a network or port variable type, the page refreshes to list available items. A search field above the list allows you to constrain the list, which updates as you type.
You can select and drag available items the list of items to include or exclude. You can also select items and click the Include or Exclude button. Use the Ctrl and Shift keys to select multiple items. You can use the configuration field below the list of included or excluded items to specify literal IP addresses and address blocks for network variables, and ports and port ranges for port variables.
A list of items to include or exclude can be comprised of any combination of literal strings and existing variables, objects, and network object groups in the case of network variables.
The following table summarizes the actions you can take to create or edit your variables.
on the variable sets page, click
Add
to add a new variable, or click the edit icon ( |
|
in the Name field, type a unique, case-sensitive alphanumeric string that includes no special characters other than the underscore character (_).
Note that variable names are case-sensitive; for example, |
|
select Network or Port from the Type drop-down list. See Working with Network Variables and Working with Port Variables for detailed information on how you can use and configure network and port variables. |
|
add an individual network object so you can then select it from the list of available networks |
select
Network
from the
Type
drop-down list, then click the add icon ( |
add an individual port object so you can then select it from the list of available ports |
select
Port
from the
Type
drop-down list, then click the add icon (
Although you can add any port type, only TCP and UDP ports, including the value |
begin typing a name in the search field above the list of available items; as you type, the page refreshes to display matching names. |
|
click the reload icon ( |
|
look for items next to the variables icon ( Note that only network groups, not port groups, are available. |
|
select objects to include or exclude in the variable definition |
click the object in the list of available networks or ports; use the Ctrl and Shift keys to select multiple objects. |
add selected items to the list of included or excluded networks or ports |
drag and drop selected items. Alternately, click Include or Exclude . You can add network and port variables and objects from the list of available items. You can also add network object groups. |
add a literal network or port to the list of networks or ports to include or exclude |
click to remove the prompt from the literal Network or Port field, type the literal IP address or address block for network variables, or the literal port or port range for port variables, then click Add . Note that you cannot enter domain names or lists; to add multiple items, add each individually. |
name the variable and select the variable type, then click Save without configuring a value. Note The variable name must be a unique, case-sensitive alphanumeric string that includes no special characters other than the underscore character ( |
|
delete a variable or object from the included or excluded list |
|
click
Save
; if you are adding a variable from custom set, then click
Yes
to use the configured value as the default value in other sets, or
No
to use a default value of |
). See 
) above the search field or the clear icon (
), network object icon (
), port icon (
), and object group icon (
).See the following sections for more information:
Access: Admin/Access Admin/Network Admin
Step 1 Select Objects > Object Management .
The Object Management page appears.
Step 3 Add a variable set or edit an existing set:
- To add a variable set, click Add Variable Set .
- To edit an existing variable set, click the edit icon (
) next to the variable set.
The new or edit variable set page appears. When naming a variable set, you can use any printable standard ASCII characters except a pipe (
|
) or curly braces (
{}
).
Step 4 Add a new variable or edit an existing variable:
) next to the variable. The new or edit variable page appears.
Tip On the variable page, you can use the right-click context menu to select or delete items; see Using the Context Menu.
Step 5 If you are adding a new variable:
You can use alphanumeric characters and the underscore (_) character.
Step 6 Optionally, move items from the list of available networks or ports to the list of included or excluded items.
You can select one or more items and then drag and drop, or click Include or Exclude . Use the Ctrl and Shift keys to select multiple items.
Tip If addresses or ports in the included and excluded lists for a network or port variable overlap, excluded addresses or ports take precedence.
Step 7 Optionally, enter a single literal value, then click Add .
For network variables, you can enter a single IP address or address block. For port variables you can add a single port or port range, separating the upper and lower values with a hyphen (-).
Repeat this step as needed to enter multiple literal values.
Step 8 Click Save to save the variable. If you are adding a new variable from a custom set, you have the following options:
Step 9 When you have finished making changes, click Save to save the variable set, then click Yes .
Your changes are saved and any access control policy the variable set is linked to displays an out-of-date status. For your changes to take effect, you must apply the access control policy where the variable set is linked to an intrusion policy; see Applying an Access Control Policy.
Working with Network Variables
Network variables represent IP addresses you can use in intrusion rules that you enable in an intrusion policy and in intrusion policy rule suppressions, dynamic rule states, and adaptive profiles. Network variables differ from network objects and network object groups in that network variables are specific to intrusion policies and intrusion rules, whereas you can use network objects and groups to represent IP addresses in various places in the system’s web interface, including access control policies, network variables, intrusion rules, network discovery rules, event searches, reports, and so on. See Working with Network Objects for more information.
You can use network variables in the following configurations to specify the IP addresses of hosts on your network:
Intrusion rule Source IPs and Destination IPs header fields allow you to restrict packet inspection to the packets originating from or destined to specific IP addresses. See Specifying IP Addresses In Intrusion Rules.
The Network field in source or destination intrusion rule suppressions allows you to suppress intrusion event notifications when a specific IP address or range of IP addresses triggers an intrusion rule or preprocessor. See Configuring Suppression Per Intrusion Policy.
The Network field in source or destination dynamic rule states allows you to detect when too many matches for an intrusion rule or preprocessor rule occur in a given time period. See Adding Dynamic Rule States.
The adaptive profiles Networks field identifies hosts in the network map where you want to improve reassembly of packet fragments and TCP streams in passive deployments. See Tuning Preprocessing in Passive Deployments.
When you use variables in the fields identified in this section, the variable set you link to an intrusion policy determines the variable values in the network traffic handled by an access control policy that uses the intrusion policy.
You can add any combination of the following network configurations to a variable:
- any combination of network variables, network objects, and network object groups that you select from the list of available networks
See Working with Network Objects for information on creating individual and group network objects using the object manager.
- individual network objects that you add from the New Variable or Edit Variable page, and can then add to your variable and to other existing and future variables
- literal, single IP addresses or address blocks
You can list multiple literal IP addresses and address blocks by adding each individually. You can list IPv4 and IPv6 addresses and address blocks alone or in any combination. When specifying IPv6 addresses, you can use any addressing convention defined in RFC 4291.
The default value for included networks in any variable you add is the word
any
, which indicates any IPv4 or IPv6 address. The default value for excluded networks is
none
, which indicates no network. You can also specify the address
::
in a literal value to indicate any IPv6 address in the list of included networks, or no IPv6 addresses in the list of exclusions.
Adding networks to the excluded list negates the specified addresses and address blocks. That is, you can match any IP address with the exception of the excluded IP address or address blocks.
For example, excluding the literal address
192.168.1.1
specifies any IP address other than 192.168.1.1, and excluding
2001:db8:ca2e::fa4c
specifies any IP address other than 2001:db8:ca2e::fa4c.
You can exclude any combination of networks using literal or available networks. For example, excluding the literal values
192.168.1.1
and
192.168.1.5
includes
any IP address other than 192.168.1.1 or 192.168.1.5. That is, the system interprets this as “
not
192.168.1.1
and not
192.168.1.5,” which matches any IP address other than those listed between brackets.
Note the following points when adding or editing network variables:
-
You cannot logically exclude the value
anywhich, if excluded, would indicate no address. For example, you cannot add a variable with the valueanyto the list of excluded networks. - Network variables identify traffic for the specified intrusion rule and intrusion policy features. Note that preprocessor rules can trigger events regardless of the hosts defined by network variables used in intrusion rules.
- Excluded values must resolve to a subset of included values. For example, you cannot include the address block 192.168.5.0/24 and exclude 192.168.6.0/24. An error message warns you and identifies the offending variable, and you cannot save your variable set when you exclude a value outside the range of included values.
For information on adding and editing network variables, see Adding and Editing Variables.
Working with Port Variables
Port variables represent TCP and UDP ports you can use in the Source Port and Destination Port header fields in intrusion rules that you enable in an intrusion policy. Port variables differ from port objects and port object groups in that port variables are specific to intrusion rules. You can create port objects for protocols other than TCP and UDP, and you can use port objects in various places in the system’s web interface, including port variables, access control policies, network discovery rules, and event searches. See Working with Port Objects for more information.
You can use port variables in the intrusion rule Source Port and Destination Port header fields to restrict packet inspection to packets originating from or destined to specific TCP or UDP ports.
When you use variables in these fields, the variable set you link to the intrusion policy associated with an access control rule or policy determines the values for these variables in the network traffic where you apply the access control policy.
You can add any combination of the following port configurations to a variable:
Note that the list of available ports does not display port object groups, and you cannot add these to variables. See Working with Port Objects for information on creating port objects using the object manager.
- individual port objects that you add from the New Variable or Edit Variable page, and can then add to your variable and to other existing and future variables
Only TCP and UDP ports, including the value
any
for either type, are valid variable values. If you use the new or edit variables page to add a valid port object that is not a valid variable value, the object is added to the system but is not displayed in the list of available objects. When you use the object manager to edit a port object that is used in a variable, you can only change its value to a valid variable value.
You must separate port ranges with a dash (-). Port ranges indicated with a colon (:) are supported for backward compatibility, but you cannot use a colon in port variables that you create.
You can list multiple literal port values and ranges by adding each individually in any combination.
Note the following points when adding or editing port variables:
-
The default value for included ports in any variable you add is the word
any, which indicates any port or port range. The default value for excluded ports isnone, which indicates no ports.
Tip To create a variable with the value any, name and save the variable without adding a specific value.
-
You cannot logically exclude the value
anywhich, if excluded, would indicate no ports. For example, you cannot save a variable set when you add a variable with the valueanyto the list of excluded ports. - Adding ports to the excluded list negates the specified ports and port ranges. That is, you can match any port with the exception of the excluded ports or port ranges.
- Excluded values must resolve to a subset of included values. For example, you cannot include the port range 10-50 and exclude port 60. An error message warns you and identifies the offending variable, and you cannot save your variable set when you exclude a value outside the range of included values.
For information on adding and editing port variables, see Adding and Editing Variables.
Resetting Variables
You can reset a variable to its default value on the variable set new or edit variables page. The following table summarizes the basic principles of resetting variables.
Resetting a variable in a custom set simply resets it to the current value for that variable in the default set.
Conversely, resetting or modifying the value of a variable in the default set always updates the default value of that variable in all custom sets. When the reset icon is grayed out, indicating that you cannot reset the variable, this means that the variable has no customized value in that set. Unless you have customized the value for a variable in a custom set, a change to the variable in the default set updates the value used in any intrusion policy where you have linked the variable set.
Note It is good practice when you modify a variable in the default set to assess how the change affects any intrusion policy that uses the variable in a linked custom set, especially when you have not customized the variable value in the custom set.
You can hover your pointer over the reset icon (
) in a variable set to see the reset value. When the customized value and the reset value are the same, this indicates one of the following:
Nesting Variables
You can nest variables so long as the nesting is not circular. Nested, negated variables are not supported.
Example: Valid Nested Variables
In the following example, SMTP_SERVERS, HTTP_SERVERS, and OTHER_SERVERS are valid nested variables.
In the following example, HOME_NET is an invalid nested variable because the nesting of HOME_NET is circular; that is, the definition of OTHER_SERVERS includes HOME_NET, so you would be nesting HOME_NET in itself.
Because nested, negated variables are not supported, you cannot use the variable NONCORE_NET as shown in the following example to represent IP addresses that are outside of your protected networks.
As an alternative to the example above, you could represent IP addresses that are outside of your protected networks by creating the variable NONCORE_NET as shown in the following example.
Linking Variable Sets to Intrusion Policies
By default, the FireSIGHT System links the default variable set to all intrusion policies used in an access control policy. When you apply an access control policy that uses an intrusion policy, intrusion rules that you have enabled in the intrusion policy use the variable values in the linked variable set.
When you modify a custom variable set used by an intrusion policy in an access control policy, the system reflects the status for that policy as out-of-date on the Access Control Policy page. You must reapply the access control policy to implement changes in your variable set. When you modify the default set, the system reflects the status of all access control policies that use intrusion policies as out-of-date, and you must reapply all access control policies to implement your changes.
See the following sections for information:
- To link a variable set other than the default set to an access control rule, see the procedure in Configuring an Access Control Rule to Perform Intrusion Prevention.
- To link a variable set other than the default set to the default action of an access control policy, see Setting Default Handling and Inspection for Network Traffic.
- To apply access control policies, including policies that link variable sets to intrusion policies, see Applying an Access Control Policy.
Understanding Advanced Variables
Advanced variables allow you to configure features that you cannot otherwise configure via the web interface. The FireSIGHT System currently provides only two advanced variables, and you can only edit the USER_CONF advanced variable.
USER_CONF provides a general tool that allows you to configure one or more features not otherwise available via the web interface.
Caution Do not use the advanced variable USER_CONF to configure an intrusion policy feature unless you are instructed to do so in the feature description or by Support. Conflicting or duplicate configurations will halt the system.
When editing USER_CONF, you can type up to 4096 total characters on a single line; the line wraps automatically. You can include any number of valid instructions or lines until you reach the 8192 maximum character length for a variable or a physical limit such as disk space. Use the backslash (\) line continuation character after any complete argument in a command directive.
Resetting USER_CONF empties it.
SNORT_BPF is a legacy advanced variable that appears only when it was configured on your system in a FireSIGHT System software release before Version 5.3.0 that you subsequently upgraded to Version 5.3.0 or greater. You can only view or delete this variable. You cannot edit it or recover it after deleting it.
This variable allowed you to apply a Berkeley Packet Filter (BPF) to filter traffic before it reached the system. You should now use access control rules instead of this variable to enforce the filtering once offered by SNORT_BPF. This variable appears only with configurations that existed before system upgrade.
Working with File Lists
Supported Devices: Any except Series 2 or X-Series
Supported Defense Centers: Any except DC500
If you use network-based advanced malware protection (AMP), and the Collective Security Intelligence Cloud incorrectly identifies a file’s disposition, you can add the file to a file list using a SHA-256 hash value to better detect the file in the future. Depending on the type of file list, you can do the following:
- To treat a file as if the cloud assigned a clean disposition, add the file to the clean list .
- To treat a file as if the cloud assigned a malware disposition, add the file to the custom detection list.
Because you manually specify the blocking behavior for these files, the system does not perform malware cloud lookups, even if the files are otherwise identified as malware by the cloud. Note that you must configure a rule in the file policy with either a Malware Cloud Lookup or Block Malware action and a matching file type to calculate a file’s SHA value. For more information, see Working with File Rules.
The system’s clean list and custom detection list are included by default in every file policy. You can opt not to use either or both lists on a per-policy basis.
Caution Do not include files on this list that are actually malware. The system does not block them, even if the cloud assigned the file’s a Malware disposition, or if you added the file to the custom detection list.
Each file list can contain up to 10000 unique SHA-256 values. To add files to the file list, you can:
- use the event viewer context menu to add a SHA-256 value.
- upload a file so the system calculates and adds the file’s SHA-256 value.
- enter a file’s SHA-256 value directly.
- create and upload a comma-separated value (CSV) source file containing multiple SHA-256 values. All non-duplicate SHA-256 values are added to the file list.
When you add a file to a file list, edit a SHA-256 value in the file list, or delete SHA-256 values from the file list, you must reapply any access control policies with file policies that use the list for the changes to take effect.
Because adding a file to a file list affects access control, you must have one of the following to manage all aspects of a file list:
- Administrator access
- a combination of Network Admin or Access Admin access (to edit the file list), Security Approver access (to reapply access control policies), and Security Analyst or Security Analyst (RO) access (to add a file using the SHA-256 value from the event view)
- a custom role with Modify Access Control Policy and Object Manager (to edit the file list), Apply Access Control Policy (to reapply access control policies), and Modify File Events (to add a file using the SHA-256 value from the event view) permissions; see Managing Your Deployment with Custom User Roles
For more information on using file lists, see the following topics:
- Using the Context Menu
- Uploading Multiple SHA-256 Values to a File List
- Uploading an Individual File to a File List
- Adding a SHA-256 Value to the File List
- Modifying Files on a File List
- Downloading a Source File from a File List
Uploading Multiple SHA-256 Values to a File List
Supported Devices: Any except Series 2 or X-Series
Supported Defense Centers: Any except DC500
You can add multiple SHA-256 values to a file list by uploading a comma-separated value (CSV) source file containing a list of SHA-256 values and descriptions. The Defense Center validates the contents and populates the file list with valid SHA-256 values.
The source file must be a simple text file with a .csv file name extension. Any header must start with a pound sign (
#
); it is treated as a comment and not uploaded. Each entry should contain a single SHA-256 value followed by a description of up to 256 alphanumeric or special characters and end with either the
LF
or
CR+LF
Newline character. The system ignores any additional information in the entry.
- Deleting a source file from the file list also removes all associated SHA-256 hashes from the file list.
- You cannot upload multiple files to a file list if the successful source file upload results in the file list containing more than 10000 distinct SHA-256 values.
-
The system truncates descriptions exceeding 256 characters to the first 256 characters on upload. If the description contains commas, you must use an escape character (
\,). If no description is included, the source file name is used instead. - If a file list contains a SHA-256 value, and you upload a source file containing that value, the newly uploaded value does not modify the existing SHA-256 value. When viewing captured files, file events, or malware events related to the SHA-256 value, any threat name or description is derived from the individual SHA-256 value.
- The system does not upload invalid SHA-256 values in a source file.
- If multiple uploaded source files contain an entry for the same SHA-256 value, the system uses the most recent value.
- If a source file contains multiple entries for the same SHA-256 value, the system uses the last one.
- You cannot directly edit a source file within the object manager. To make changes, you must first modify your source file directly, delete the copy on the system, then upload the modified source file. See Downloading a Source File from a File List for more information.
To upload a source file to a file list:
Access: Admin/Any Security Analyst
Step 1 Select Objects > Object Management .
The Object Management page appears.
The File List section appears.
Step 3 Click the edit icon (
) next to the file list where you want to add values from a source file.
The File List pop-up window appears.
Step 4 Select
List of SHAs
from the
Add by
field.
The pop-up window updates to include new fields.
Step 5 Optionally, enter a description of the source file in the Description field.
If you do not enter a description, the system uses the file name.
Step 6 Click Browse to browse to the source file, then click Upload and Add List to add the list.
The source file is added to the file list. The SHA-256 column lists how many SHA-256 values the file contains.
Step 8 Reapply all access control policies with file policies that use the file list.
After the policies apply, the system no longer performs malware cloud lookups on files in the file list.
Uploading an Individual File to a File List
Supported Devices: Any except Series 2 or X-Series
Supported Defense Centers: Any except DC500
If you have a copy of the file you want to add to a file list, you can upload the file to the Defense Center for analysis; the system calculates the file’s SHA-256 value and adds the file to the list. The system does not enforce a limit on the size of files for SHA-256 calculation.
To add a file by having the Defense Center calculate its SHA-256 value:
Step 1 On the object manager’s File List page, click the edit icon (
) next to the clean list or custom detection list where you want to add a file.
The File List pop-up window appears.
Step 2 Select
Calculate SHA
from the
Add by
field.
The pop-up window updates to include new fields.
Step 3 Optionally, enter a description of the file in the Description field.
If you do not enter a description, the file name is used for the description on upload.
Step 4 Click Browse to browse to the source file, then click Calculate and Add SHA to add the list.
The file is added to the file list.
Step 6 Reapply all access control policies with file policies that use the file list.
After the policies apply, the system no longer performs malware cloud lookups on files in the file list.
Adding a SHA-256 Value to the File List
Supported Devices: Any except Series 2 or X-Series
Supported Defense Centers: Any except DC500
You can submit a file’s SHA-256 value to add it to a file list. You cannot add duplicate SHA-256 values.
Tip Right-click a file or malware event from the event view and select Show Full Text in the context menu to view and copy the full SHA-256 value for the file.
To add a file by manually entering the file’s SHA-256 value:
Step 1 On the object manager’s File List page, click the edit icon (
) next to the clean list or custom detection list where you want to add a file.
The File List pop-up window appears.
Step 2 Select
Enter SHA Value
from the
Add by
field.
The pop-up window updates to include new fields.
Step 3 Enter a description of the source file in the Description field.
Step 4 Type or paste the file’s entire SHA-256 value. The system does not support matching partial values.
Step 5 Click Add to add the file.
The file is added to the file list.
Step 7 Reapply all access control policies with file policies that use the file list.
After the policies apply, the system no longer performs malware cloud lookups on files in the file list.
Modifying Files on a File List
Supported Devices: Any except Series 2 or X-Series
Supported Defense Centers: Any except DC500
You can edit or delete individual SHA-256 values on a file list. Note that you cannot directly edit a source file within the object manager. To make changes, you must first modify your source file directly, delete the copy on the system, then upload the modified source file. See Downloading a Source File from a File List for more information. To edit a file on a file list:
Step 1 On the object manager’s File List page, click the edit icon (
) next to the clean list or custom detection list where you want to modify a file.
The File List pop-up window appears.
Step 2 Next to the SHA-256 value you want to edit, click the edit icon (
).
The Edit SHA-256 pop-up window appears.
Tip You can also delete files from the list. Next to the file you want to remove, click the delete icon ().
Step 3 Update the SHA-256 value or Description .
The File List pop-up window appears. The system updates the file entry in the list.
Step 6 Reapply all access control policies with file policies that use the file list.
After the policies apply, the system no longer performs malware cloud lookups on files in the file list.
Downloading a Source File from a File List
Supported Devices: Any except Series 2 or X-Series
Supported Defense Centers: Any except DC500
You can view, download, or delete existing source file entries on a file list. Note that you cannot edit a source file once uploaded. You must first delete the source file from the file list, then upload an updated file. For more information on uploading a source file, see Uploading Multiple SHA-256 Values to a File List.
The number of entries associated with a source file refers to the number of distinct SHA-256 values. If you delete a source file from a file list, the total number of SHA-256 entries the file list contains decreases by the number of valid entries in the source file.
Step 1 On the object manager’s File List page, click the edit icon (
) next to the clean list or custom detection list where you want to download a source file.
The File List pop-up window appears.
Step 2 Next to the source file you want to download, click the view icon (
).
The View SHA-256’s in list pop-up window appears.
Step 3 Click Download SHA List and follow the prompts to save the source file.
The File List pop-up window appears.
Working with Security Zones
A security zone is a grouping of one or more inline, passive, switched, routed, or ASA interfaces that you can use to manage and classify traffic flow in various policies and configurations. The interfaces in a single zone may span multiple devices; you can also configure multiple zones on a single device. This allows you to divide the network into segments where you can apply various policies. You must assign at least one interface to a security zone to match traffic against that security zone, and each interface can belong to only one zone.
In addition to using security zones to group interfaces, you can use zones in various places in the system’s web interface, including access control policies, network discovery rules, and event searches. For example, you could write an access control rule that applies only to a specific source or destination zone, or restrict network discovery to traffic to or from a specific zone.
When you update a security zone object, the system saves a new revision of the object. As a result, if you have managed devices in the same security zone that have different revisions of the security zone object, you may log what appear to be duplicate connections. If you notice duplicate connection reporting, you can update all managed devices to use the same revision of the object. In the object manager, edit the security zone, remove all managed devices, save the object, re-add the managed devices, and save the object again. Then, reapply all affected device policies. For more information on applying device policies, see Applying Changes to Devices.
You create security zones in one of the following ways:
- The system creates security zones upon device registration, depending on the detection mode you selected for the device during its initial configuration. For example, the system creates a Passive zone in passive deployments, while in inline deployments the system creates External and Internal zones.
- You can create security zones on the fly while configuring interfaces on a managed device.
- You can create security zones using the object manager ( Objects > Object Management ).
The Security Zones page of the object manager lists the zones configured on your managed devices. The page also displays the type of interfaces in each zone, and you can expand each zone to view which interfaces on which devices belong to each zone.
Note All interfaces in a security zone must be of the same type, that is, all inline, passive, switched, routed, or ASA. Further, after you create a security zone, you cannot change the type of interfaces it contains.
If you modify your ASA security contexts, switching from single context mode to multi-context mode or visa versa, the system removes all interfaces from your security zone configurations.
You cannot delete a security zone that is in use. After you add or remove interfaces from a zone, you must reapply the device configuration to the devices where the interfaces reside. You must also reapply the access control and network discovery policies that use the zone.
Access: Admin/Access Admin/Network Admin
Step 1 Select Objects > Object Management .
The Object Management page appears.
Step 2 Select Security Zones .
Step 3 Click Add Security Zone .
The Security Zones pop-up window appears.
Step 4 Type a
Name
for the zone. You can use any printable standard ASCII characters except curly braces (
{}
), a pipe (
|
), a semicolon (
;
), or the pound sign (
#
).
Step 5 Select an interface Type for the zone.
After you create a security zone, you cannot change its type.
Step 6 From the Device > Interfaces drop-down list, select a device that contains interfaces you want to add to the zone.
Step 7 Select one or more interfaces.
Use the Shift and Ctrl keys to select multiple objects. If you have not yet configured interfaces on your managed devices, you can create an empty zone and add interfaces to it later; skip to step 10 .
The interfaces you selected are added to the zone, grouped by device.
Step 9 Repeat steps 6 through 8 to add interfaces on other devices to the zone.
Working with Cipher Suite Lists
A cipher suite list is an object comprised of several cipher suites. Each pre-defined cipher suite value represents a cipher suite used to negotiate an SSL- or TLS-encrypted session. You can use cipher suites and cipher suite lists in SSL rules to control encrypted traffic based on whether the client and server negotiated the SSL session using that cipher suite. If you add a cipher suite list to an SSL rule, SSL sessions negotiated with any of the cipher suites in the list match the rule.
Note Although you can use cipher suites in the web interface in the same places as cipher suite lists, you cannot add, modify, or delete cipher suites.
You cannot delete a cipher suite list that is in use. Additionally, after you edit a cipher suite list used in an SSL policy, you must reapply the associated access control policy for your changes to take effect.
To create a cipher suite list:
Access: Admin/Access Admin/Network Admin
Step 1 Select Objects > Object Management .
The Object Management page appears.
Step 2 Select Cipher Suite List .
Step 3 Click Add Cipher Suites .
The Cipher Suite List pop-up window appears.
Step 4 Type a
Name
for the cipher suite list. You can use any printable standard ASCII characters except a pipe (
|
) or curly braces (
{}
).
Step 5 Select one or more cipher suites and click Add .
- Use Shift and Ctrl to select multiple cipher suites, or right-click and Select All .
- Use the filter field (
) to search for existing cipher suites to include, which updates as you type to display matching items. Click the reload icon (
) above the search field or click the clear icon (
) in the search field to clear the search string. The cipher suite list is created.
Working with Distinguished Name Objects
Each distinguished name object represents the distinguished name listed for a public key certificate’s subject or issuer. You can use distinguished name objects and groups (see Grouping Objects) in SSL rules to control encrypted traffic based on whether the client and server negotiated the SSL session using a server certificate with the distinguished name as subject or issuer.
Your distinguished name object can contain the common name attribute (
CN
). If you add a common name without “
CN=
” then the system prepends “
CN=
” before saving the object.
You can also add a distinguished name with one of each attribute listed in the following table, separated by commas.
|
up to 64 alphanumeric, backslash ( / ), hyphen ( - ), quotation ( " ), or asterisk ( * ) characters, or spaces |
||
You can define one or more asterisks ( * ) as wild cards in an attribute. In a common name attribute, you can define one or more asterisks per domain name label. Wild cards match only within that label, though you can define multiple labels with wild cards. See the following table for examples.
You cannot delete a distinguished name object that is in use. Additionally, after you edit a distinguished name object used in an SSL policy, you must reapply the associated access control policy for your changes to take effect.
To add a distinguished name object:
Access: Admin/Access Admin/Network Admin
Step 1 Select Objects > Object Management .
The Object Management page appears.
Step 2 Under Distinguished Name , select Individual Objects .
Step 3 Click Add Distinguished Name .
The Distinguished Name pop-up window appears.
Step 4 Type a
Name
for the distinguished name object. You can use any printable standard ASCII characters except a pipe (
|
) or curly braces (
{}
).
Step 5 In the DN field, type a value for the distinguished name or common name. You have the following options:
- If you add a distinguished name, you can include one of each attribute listed in Table 3-11 separated by commas.
- If you add a common name, you can include multiple labels and wild cards.
The distinguished name object is added.
Working with PKI Objects
PKI objects represent the public key certificates and paired private keys required to support your SSL inspection deployment. Internal and trusted CA objects consist of certificate authority (CA) certificates; internal CA objects also contain the private key paired with the certificate. Internal and external certificate objects consist of server certificates; internal certificate objects also contain the private key paired with the certificate. Using these objects in SSL rules, you can decrypt:
- outgoing traffic by re-signing the server certificate with an internal CA object
- incoming traffic using the known private key in an internal certificate object
You can also create SSL rules and match traffic encrypted with:
- the certificate in an external certificate object
- a certificate either signed by the CA in a trusted CA object, or within the CA’s chain of trust
You can manually input certificate and key information, upload a file containing that information, or in some cases, generate a new CA certificate and private key.
When you view a list of PKI objects in the object manager, the system displays the certificate’s Subject distinguished name as the object value. Hover your pointer over the value to view the full certificate Subject distinguished name. To view other certificate details, edit the PKI object.
Note The Defense Center and managed devices encrypt all private keys stored in internal CA objects and internal certificate objects with a randomly generated key before saving them. If you upload private keys that are password protected, the appliance decrypts the key using the user-supplied password, then reencrypts it with the randomly generated key before saving it.
For more information, see the following sections:
- Working with Internal Certificate Authority Objects
- Working with Trusted Certificate Authority Objects
- Working with External Certificate Objects
- Working with Internal Certificate Objects
Working with Internal Certificate Authority Objects
Each internal certificate authority (CA) object you configure represents the CA public key certificate of a CA your organization controls. The object consists of the object name, CA certificate, and paired private key. You can use internal CA objects and groups (see Grouping Objects) in SSL rules to decrypt outgoing encrypted traffic by re-signing the server certificate with the internal CA.
Note If you reference an internal CA object in a Decrypt - Resign SSL rule and the rule matches an encrypted session, the user’s browser may warn that the certificate is not trusted while negotiating the SSL handshake. To avoid this, add the internal CA object certificate to either the client or domain list of trusted root certificates.
You can create an internal CA object in the following ways:
- import an existing RSA-based or elliptic curve-based CA certificate and private key
- generate a new self-signed RSA-based CA certificate and private key
- generate an unsigned RSA-based CA certificate and private key. You must submit a certificate signing request (CSR) to another CA to sign the certificate before using the internal CA object.
After you create an internal CA object containing a signed certificate, you can download the CA certificate and private key. The system encrypts downloaded certificates and private keys with a user-provided password.
Whether system-generated or user-created, you can modify the internal CA object name, but cannot modify other object properties.
You cannot delete an internal CA object that is in use. Additionally, after you edit an internal CA object used in an SSL policy, the associated access control policy goes out-of-date. You must reapply the access control policy for your changes to take effect.
Importing a CA Certificate and Private Key
You can configure an internal CA object by importing an X.509 v3 CA certificate and private key. You can upload files encoded in one of the following supported formats:
If the private key file is password-protected, you can supply the decryption password. If the certificate and key are encoded in the PEM format, you can also copy and paste the information.
You can upload only files that contain proper certificate or key information, and that are paired with each other. The system validates the pair before saving the object.
Note If you configure a rule with the Decrypt - Resign action, the rule matches traffic based on the referenced internal CA certificate’s encryption algorithm type, in addition to any configured rule conditions. You must upload an elliptic curve-based CA certificate to decrypt outgoing traffic encrypted with an elliptic curve-based algorithm, for example. For more information, see Decrypt Actions: Decrypting Traffic for Further Inspection.
To import an internal CA certificate and private key:
Access: Admin/Access Admin/Network Admin
Step 1 Select Objects > Object Management .
The Object Management page appears.
Step 2 Under PKI , select Internal CAs .
The Import Internal Certificate Authority pop-up window appears.
Step 4 Type a
Name
for the internal CA object. You can use any printable standard ASCII characters except a pipe (
|
) or curly braces (
{}
).
Step 5 Above the Certificate Data field, click Browse to upload a DER or PEM-encoded X.509 v3 CA certificate file.
Step 6 Above the Key field, click Browse to upload a DER or PEM-encoded paired private key file.
Step 7 If the uploaded file is password-protected, select the Encrypted, and the password is: check box and enter the password.
The internal CA object is added.
Generating a New CA Certificate and Private Key
You can configure an internal CA object by providing identification information to generate a self-signed RSA-based CA certificate and private key. The following table describes the identification information you provide to generate the certificate.
|
up to 64 alphanumeric, backslash ( / ), hyphen ( - ), quotation ( " ), asterisk ( * ), period ( . ), or space characters |
||
The generated CA certificate is valid for ten years. The Valid From date is a week before generation.
To generate a self-signed CA certificate:
Access: Admin/Access Admin/Network Admin
Step 1 Select Objects > Object Management .
The Object Management page appears.
Step 2 Under PKI , select Internal CAs .
The Generate Internal Certificate Authority pop-up window appears.
Step 4 Type a
Name
for the internal CA object. You can use any printable standard ASCII characters except a pipe (
|
) or curly braces (
{}
).
Step 5 Type the identification attributes, as described in Table 3-13.
Step 6 Click Generate self-signed CA .
The internal CA object is added.
Obtaining and Uploading a New Signed Certificate
You can configure an internal CA object by obtaining a signed certificate from a CA. This involves two steps:
- Provide identification information to configure the internal CA object. This generates an unsigned certificate and paired private key, and creates a certificate signing request (CSR) to a CA you specify.
- After the CA issues the signed certificate, upload it to the internal CA object, replacing the unsigned certificate.
You can only reference an internal CA object in an SSL rule if it contains a signed certificate.
To create an unsigned CA certificate and CSR:
Access: Admin/Access Admin/Network Admin
Step 1 Select Objects > Object Management .
The Object Management page appears.
Step 2 Under PKI , select Internal CAs .
The Generate Internal Certificate Authority pop-up window appears.
Step 4 Type a
Name
for the internal CA object. You can use any printable standard ASCII characters except a pipe (
|
) or curly braces (
{}
).
Step 5 Type the identification attributes, as described in Table 3-13.
The Generate Internal Certificate Authority pop-up window appears.
Step 7 Copy the CSR to submit to a CA.
The CA object is created. Note that before you can use it, you must upload a signed certificate issued by a CA.
To upload a signed certificate issued in response to a CSR:
Access: Admin/Access Admin/Network Admin
Step 1 Select Objects > Object Management .
The Object Management page appears.
Step 2 Under PKI , select Internal CAs .
Step 3 Click the edit icon (
) next to the CA object containing the unsigned certificate awaiting the CSR.
The Edit Internal Certificate Authority pop-up window appears.
Step 4 Click Install Certificate .
The Install Internal Certificate Authority pop-up window appears.
Step 5 Above the Certificate Data field, click Browse to upload a DER or PEM-encoded X.509 v3 CA certificate file.
Step 6 If the uploaded file is password protected, select the Encrypted, and the password is: check box and enter the password.
The CA object contains a signed certificate, and can be referenced in SSL rules.
Downloading a CA Certificate and Private Key
You can back up or transfer a CA certificate and paired private key by downloading a file containing the certificate and key information from an internal CA object.
The system encrypts the private key stored in an internal CA object with a randomly generated key before saving it to disk. If you download a certificate and private key from an internal CA object, the system first decrypts the information before creating a file containing the certificate and private key information. You must then provide a password the system uses to encrypt the downloaded file.
Caution Private keys downloaded as part of a system backup are decrypted, then stored in the unencrypted backup file. For more information, see Creating Backup Files.
To download an internal CA certificate and private key:
Access: Admin/Access Admin/Network Admin
Step 1 Select Objects > Object Management .
The Object Management page appears.
Step 2 Under PKI , select Internal CAs .
Step 3 Click the edit icon (
) next to the internal CA object whose certificate and private key you want to download.
The Edit Internal Certificate Authority pop-up window appears.
The Encrypt Download File pop-up window appears.
Step 5 Type an encryption password in the Password and Confirm Password fields.
You are prompted to save the file.
Working with Trusted Certificate Authority Objects
Each trusted certificate authority (CA) object you configure represents a CA public key certificate belonging to a trusted CA outside your organization. The object consists of the object name and CA public key certificate. You can use external CA objects and groups (see Grouping Objects) in the SSL policy to control traffic encrypted with a certificate signed either by the trusted CA, or any CA within the chain of trust.
After you create the trusted CA object, you can modify the name and add certificate revocation lists (CRL), but cannot modify other object properties. There is no limit on the number of CRLs you can add to an object. If you want to modify a CRL you have uploaded to an object, you must delete the object and recreate it.
You cannot delete a trusted CA object that is in use. Additionally, after you edit a trusted CA object used in an SSL policy, the associated access control policy goes out-of-date. You must reapply the access control policy for your changes to take effect.
Adding a Trusted CA Object
You can configure an external CA object by uploading an X.509 v3 CA certificate. You can upload a file encoded in one of the following supported formats:
If the file is password-protected, you must supply the decryption password. If the certificate is encoded in the PEM format, you can also copy and paste the information.
You can upload a CA certificate only if the file contains proper certificate information; the system validates the certificate before saving the object.
To import a trusted CA certificate:
Access: Admin/Access Admin/Network Admin
Step 1 Select Objects > Object Management .
The Object Management page appears.
Step 2 Under PKI , select Trusted CAs .
Step 3 Click Add Trusted CAs .
The Import Trusted Certificate Authority pop-up window appears.
Step 4 Type a
Name
for the trusted CA object. You can use any printable standard ASCII characters except a pipe (
|
) or curly braces (
{}
).
Step 5 Above the Certificate Data field, click Browse to upload a DER or PEM-encoded X.509 v3 CA certificate file.
Step 6 If the file is password-protected, select the Encrypted, and the password is: check box and enter the password.
The trusted CA object is added.
Adding a Certificate Revocation List to a Trusted CA Object
You can upload CRLs to a trusted CA object. If you reference that trusted CA object in an SSL policy, you can control encrypted traffic based on whether the CA that issued the session encryption certificate subsequently revoked the certificate. You can upload files encoded in one of the following supported formats:
After you add the CRL, you can view the list of revoked certificates. If you want to modify a CRL you have uploaded to an object, you must delete the object and recreate it.
You can upload only files that contain a proper CRL. There is no limit to the number of CRLs you can add to a trusted CA object. However, you must save the object each time you upload a CRL, before adding another CRL.
Access: Admin/Access Admin/Network Admin
Step 1 Select Objects > Object Management .
The Object Management page appears.
Step 2 Under PKI , select Trusted CAs .
Step 3 Click the edit icon (
) next to a trusted CA object.
The Edit Trusted Certificate Authority pop-up window appears.
Step 4 Click Add CRL to upload a DER or PEM-encoded CRL file.
Working with External Certificate Objects
Each external certificate object you configure represents a server public key certificate that does not belong to your organization. The object consists of the object name and certificate. You can use external certificate objects and groups (see Grouping Objects) in SSL rules to control traffic encrypted with the server certificate. For example, you can upload a self-signed server certificate that you trust, but cannot verify with a trusted CA certificate.
You can configure an external certificate object by uploading an X.509 v3 server certificate. You can upload a file in one of the following supported formats:
You can upload only files that contains proper server certificate information; the system validates the file before saving the object. If the certificate is encoded in the PEM format, you can also copy and paste the information.
After you create the external certificate object, you can modify the name, but cannot modify other object properties.
You cannot delete an external certificate object that is in use. Additionally, after you edit an external certificate object used in an SSL policy, the associated access control policy goes out-of-date. You must reapply the access control policy for your changes to take effect.
To add an external certificate object:
Access: Admin/Access Admin/Network Admin
Step 1 Select Objects > Object Management .
The Object Management page appears.
Step 2 Under PKI , select External Certs .
Step 3 Click Add External Cert .
The Add Known External Certificate pop-up window appears.
Step 4 Type a
Name
for the external certificate object. You can use any printable standard ASCII characters except a pipe (
|
) or curly braces (
{}
).
Step 5 Above the Certificate Data field, click Browse to upload a DER or PEM-encoded X.509 v3 server certificate file.
The internal CA object is added.
Working with Internal Certificate Objects
Each internal certificate object you configure represents a server public key certificate belonging to your organization. The object consists of the object name, public key certificate, and paired private key. You can use internal certificate objects and groups (see Grouping Objects) in SSL rules to decrypt traffic incoming to one of your organization’s servers using the known private key.
You can configure an internal certificate object by uploading an X.509 v3 RSA-based or elliptic curve-based server certificate and paired private key. You can upload a file in one of the following supported formats:
If the file is password-protected, you must supply the decryption password. If the certificate and key are encoded in the PEM format, you can also copy and paste the information.
You can upload only files that contain proper certificate or key information, and that are paired with each other. The system validates the pair before saving the object.
After you create the internal certificate object, you can modify the name, but cannot modify other object properties.
You cannot delete an internal certificate object that is in use. Additionally, after you edit an internal certificate object used in an SSL policy, the associated access control policy goes out-of-date. You must reapply the access control policy for your changes to take effect.
To add an internal certificate object:
Access: Admin/Access Admin/Network Admin
Step 1 Select Objects > Object Management .
The Object Management page appears.
Step 2 Under PKI , select Internal Certs .
Step 3 Click Add Internal Cert .
The Add Known Internal Certificate pop-up window appears.
Step 4 Type a
Name
for the internal certificate object. You can use any printable standard ASCII characters except a pipe (
|
) or curly braces (
{}
).
Step 5 Above the Certificate Data field, click Browse to upload a DER or PEM-encoded X.509 v3 server certificate file.
Step 6 Above the Key field, or click Browse to upload a DER or PEM-encoded paired private key file.
Step 7 If the uploaded private key file is password-protected, select the Encrypted, and the password is: check box and enter the password.
The internal certificate object is added.
Working with Geolocation Objects
Supported Devices: Series 3, virtual, ASA FirePOWER
Supported Defense Centers: All except DC500
Each geolocation object you configure represents one or more countries or continents that the system has identified as the source or destination of traffic on your monitored network. You can use geolocation objects in various places in the system’s web interface, including access control policies, SSL policies, and event searches. For example, you could write an access control rule that blocks traffic to or from certain countries. For information on filtering traffic by geographical location, see Controlling Traffic by Network or Geographical Location. For information on filtering encrypted traffic by geographic location, see Controlling Encrypted Traffic by Network or Geographical Location.
To ensure that you are using up-to-date information to filter your network traffic, Cisco strongly recommends that you regularly update your Geolocation Database (GeoDB). For information on downloading and installing GeoDB updates, see Updating the Geolocation Database.
You cannot delete a geolocation object that is in use. Additionally, after you edit a geolocation object used in an access control policy or SSL policy, you must reapply the access control policy for your changes to take effect.
Access: Admin/Access Admin/Network Admin
Step 1 Select Objects > Object Management .
The Object Management page appears.
The Geolocation Objects page appears.
Step 3 Click Add Geolocation .
The Geolocation Object pop-up window appears.
Step 4 Type a
Name
for the geolocation object. You can use any printable standard ASCII characters except a pipe (
|
) or curly braces (
{}
).
Step 5 Select the check boxes for the countries and continents you want to include in your geolocation object.
Selecting a continent selects all countries within that continent, as well as any countries that GeoDB updates may add under that continent in the future. Deselecting any country under a continent deselects the continent. You can select any combination of countries and continents.
The geolocation object is added.
Feedback