Cisco IOS IPS

You can configure Cisco IOS IPS in three ways: Cisco Router CLI, Cisco Router and Security Device Manager (SDM) and CiscoWorks.
Only A basic set of Cisco IOS IPS commands is available in the CLI. The best way to configure CiscoIOS IPS is to use Cisco Router and Security Device Manager (SDM)

Basic Cisco IOS IPS Configuration Tasks
Step 1: Initialize the Cisco IOS IPS on the router
Gateway(config)#ip ips notify sdee
Gateway(config)#ip ips notify log

Gateway(config)#ip sdee alerts ?
<10-2000> Number of SDEE alerts to store
Gateway(config)#ip sdee messages ?
<10-500> Number of SDEE messages to store
Gateway(config)#ip sdee subscriptions ?
<1-3> Number of concurrent SDEE subscriptions

Step 2: Configure signatures
Gateway(config)#ip ips sdf location flash:128MB.sdf

Step 3: Creating and Applying IPS Rules
Gateway(config)#ip access-list extended IPSOutside
Gateway(config-ext-nacl)#100 permit ip any any
Gateway(config-ext-nacl)#exit
Gateway(config)#ip ips name IPSOutside list IPSOutside

Gateway(config-if)#ip ips
Gateway(config-if)#ip ips IPSOutside in

Step 4 Verifying the Cisco IOS IPS Configuration
Gateway#show ip ips all
Gateway#show ip ips configuration
Gateway#show ip ips interfaces
Gateway#show ip ips statistics
Gateway#show ip ips signatures

Configuring Authentication Proxy using local database

Authentication Proxy Configuration Tasks
Configuring the Cisco IOS Firewall requires four tasks:

1. Configure AAA
2. Configure the HTTP server
3. Configure authentication proxy
4. Verify the authentication proxy configuration

Configuring the Cisco Secure ACS requires three tasks:

1. Network Configuration
2. Interface Configuration
3. Authentication Proxy Configuration

Configuring Authentication Proxy using local database
Configure AAA
Gateway#config terminal
Gateway(config)#aaa new-model
Gateway(config)#aaa authentication login default local
Gateway(config)#aaa authorization auth-proxy default local
Gateway(config)#username ebay password paypal

Configure the HTTP server
(The HTTP server is used by the Cisco IOS Firewall to send the login page to the client)
Gateway(config)#ip http secure-server // or Gateway(config)#ip http server
% Generating 1024 bit RSA keys, keys will be non-exportable...[OK]
Gateway(config)#ip http authentication local //Use local database
Gateway(config)#username wangyu privilege 15 password ws1026

Gateway(config)#access-list 2 remark Used By Router's Http Server
Gateway(config)#access-list 2 deny any
Gateway(config)#ip http access-class 2

Configure authentication proxy
Gateway(config)#ip auth-proxy name allowed-outbound http absolute-timer 30
Gateway(config)#ip auth-proxy name allowed-outbound ftp
Gateway(config)#ip auth-proxy name allowed-outbound telnet
Gateway(config)#ip auth-proxy auth-proxy-banner http # Authentication Proxy #

Gateway(config)#int fa0/1.60
Gateway(config-subif)#ip auth-proxy allowed-outbound
Gateway(config-subif)#exit
Gateway(config)#


Verify the authentication proxy configuration
Gateway#show ip auth-proxy cache
Gateway#show ip auth-proxy watch-list
Gateway#show ip auth-proxy configuration
Gateway#clear ip auth-proxy cache *

Detecing and Protecting Against DoS Attacks Step by Step

Reference:
Defining Strategies to Protect Against TCP SYN Denial of Service Attacks
Configuring TCP Intercept (Prevent Denial-of-Service Attacks)
Denial of Service Tuning for Cisco IOS Software Firewall and IPS

Is the TCP Intercept feature needed with Context-Based Access Control (CBAC)?Cisco IOS Intrusion Detection System (IDS)/CBAC and the TCP Intercept feature work independently of each other and, should not be used together due to the fact that they use the same internal engine.

Detecting DoS Attacks
1, Tuning parameters for Cisco IOS Software Firewall and IPS
Default Values
DoS Protection Value Prior to 12.4(11)T/12.4(10) 12.4(11)T/12.4(10) and later
max-incomplete high value 500 Unlimited
max-incomplete low value 400 Unlimited
one-minute high value 500 Unlimited
one-minute low value 400 Unlimited
tcp max-incomplete host value 50 Unlimited

The counter for “ip inspect one-minute high” and “ip inspect one-minute low” maintains a sum of all TCP, UDP, and Internet Control Message Protocol (ICMP) connection attempts within the prior minute of the operation of the router, whether the connections have been successful or not. A rising connection rate can be indicative of a worm infection on a private network or an attempted DoS attack against a server.

max-incomplete tcp connections per host is 100000. Block-time 0 minute.



The DoS settings can be viewed with the exec command show ip inspect config, and the settings are included with the output of sh ip inspect all.


Follow this procedure to tune the DoS protection of your firewall to the activity of your network:
1, Be sure that your network is not infected with viruses or worms that can lead to erroneously large half-open connection values or attempted connection rates.

2, Set the max-incomplete high values to very high values:
ip inspect max-incomplete high 20000000
ip inspect one-minute high 100000000
ip inspect tcp max-incomplete host 100000 block-time 0

3,Clear the Cisco IOS Firewall statistics with this command: show ip inspect statistics reset

4, Leave the router configured in this state for some time, perhaps as long as 24 to 48 hours, so you can observe the network pattern over at least one full day of the typical network activity cycle.

5, After the observation period, check the DoS counters with this command: show ip inspect statistics

Maxever session counts (estab/half-open/terminating) [207:56:35]
Maxever session creation rate 330  

Configure ip inspect max-incomplete high to a value 25-percent higher than the indicated maxever session count half-open value of your router.
for example: Maxever session counts (estab/half-open/terminating) [207:56:35]
56 * 1.25 = 70
Configure: router(config)#ip inspect max-incomplete high 70

Configure ip inspect max-incomplete low to the value your router displayed for its maxever session count half-open value, for example: Maxever session counts (estab/half-open/terminating) [207:56:35] Configure: router(config)#ip inspect max-incomplete low 56

Maxever session counts (estab/half-open/terminating) [207:56:35]
(207 + 56 + 35) * 1.1 = 328
Configure: ip inspect one-minute low 328 If the router runs Cisco IOS Software Release 12.4(11)T or later, or 12.4(10) or later, you can simply apply the value shown in the “Maxever session creation rate” inspection statistic: Maxever session creation rate 330 Configure: ip inspect one-minute low 330

Calculate and configure ip inspect one-minute high. The ip inspect one-minute high value must be 25-percent greater than the calculated one-minute low value, for example: ip inspect one-minute low (330) * 1.25 = 413 Configure: ip inspect one-minute high 413

You need to define a value for ip inspect tcp max-incomplete host in accordance with your knowledge of the capability of your servers.

• ip inspect max-incomplete high 500—This global command instructs IOS to start deleting the half-open sessions if the number of existing sessions is 500. The number of half-open sessions cannot exceed 500.

• ip inspect max-incomplete low 400—This global command instructs IOS to stop deleting the half-open sessions if the number of existing half-open sessions is 400.

• ip inspect one-minute high 500—This global command instructs IOS to start deleting the half-open sessions if the rate of half-open TCP sessions exceeds 500 sessions per minute.

• ip inspect one-minute low 400—This global command instructs IOS to stop deleting the half-open sessions if the rate of half-open TCP session falls to 400 sessions per minute.

• ip inspect tcp synwait-time 30—This global command defines the wait time before a half-open TCP session is dropped.

Protecting DoS Attacks

Cisco IOS Firewall

A Basic Cisco IOS Firewall Example

Least complex Cisco IOS SPI configuration tasks:

1. Configure ACLs to block traffic from the unsecure network.
2. Be sure ACLs permit legitimate traffic connections from the secure network to the unsecure network.
3. Create inspection rules. Apply the rules inbound to the secure-side interface or outbound to the unsecure-side interface.
4. Verify firewall function.

Let's dive in
Gateway(config)#access-list 100 deny tcp any any
Gateway(config)#access-list 100 deny udp any any
Gateway(config)#access-list 100 permit icmp any any echo-reply
Gateway(config)#access-list 100 permit icmp any any time-exceeded
Gateway(config)#access-list 100 permit icmp any any traceroute
Gateway(config)#access-list 100 permit icmp any any unreachable
Gateway(config)#access-list 100 deny ip any any
Gateway(config)#access-list 100 remark Block All Traffice Comes From Internet
//Don't use only "Deny Ip any any". CBCA only support TCP,UDP and common-type ICMP. If you only "Deny ip any any" you will block the traffic that CBCA doesn't support.


Gateway(config)#int dialer 1
Gateway(config-if)#ip access-group 100 in
Gateway(config-if)#exit


Gateway(config)#ip inspect name ServerFarmVlan110 dns
Gateway(config)#int fa0/1.110
Gateway(config-subif)#ip inspect ServerFarmVlan110 in
Gateway(config-subif)#exit


Inspect Rule for HTTP
Gateway(config)#ip inspect name UserInspect https
Gateway(config)#ip inspect name UserInspect http



Monitoring
show ip inspect sessions

Cisco IOS URL Filtering

What is Cisco IOS URL Filtering?
The Cisco IOS URL Filtering solution monitors and regulates all web activities by blocking specific websites or restricting access to certain websites. The Cisco IOS URL Filtering is a simple and easy to deploy solution. It is fully integrated with Cisco IOS.

FACTS
Supports up to 256 static URLs that can be configured in the router's NVRAM.
Supports Complete or Partical Domain name
Complete domain name : www.yahoo.com
Partial domain name: .yahoo.com

Cisco IOS URL Filtering without External Filtering Servers
Step One: URLFilter Rule
Gateway(config)#ip inspect name UserInspect http urlfilter
Gateway(config)#ip urlfilter allow-mode on
Gateway(config)#ip urlfilter exclusive-domain deny www.whitehouse.com
//Cisco IOS Software will not make a lookup request to any external filtering servers for the HTTP traffice that is destined to one of the domains in the exclusive list specified

Step Two: Apply URLfilter to interface
Gateway(config)#interface fastEthernet 0/1.10
Gateway(config-subif)#ip inspect UserInspect in
Gateway(config-subif)#exit

Step Three: Disable Java applet scanner and Save
Gateway(config)#ip inspect name UserInspect http java-list 2
Gateway(config)#access-list 2 permit any
Gateway(config)#access-list 2 remark UsedByUserInspect Rule
Gateway#wr
//Write to NVRAM, otherwise Urlfilter may not work.
//Enabling HTTP inspection with or without any option triggers a Java applet scanner, which is very CPU-intensive. The only way to stop java applet scanner is to specify the "java-list" and then configure a standard ACL to allow any traffic.


Two Methods for Standalone Cisco IOS URL Filtering
Method One: White Lists
Permit Certain WebSites and deny the rest
Gateway(config)#ip urlfilter allow-mode on
Gateway(config)#ip urlfilter exclusive-domain permit www.cisco.com

Method Two: Black Lists
Deny Certain Websites and permit the rest
Gateway(config)#ip urlfilter allow-mode on
Gateway(config)#ip urlfilter exclusive-domain deny www.whitehouse.com

// If allow-mode is on and the external servers are down(or without external servers), the HTTP requests will be allowed to pass. If the allow-mode is off and the external servers are down(or without external servers), the HTTP requests will be forbidden.
Allow mode is off by default.

Tips
After configuring URLfilter exclusive-domain, you may need to reload router,otherwise the URLfilter may not work properly.