F5 Logo MyF5
Search
  1. MyF5 Home
  2. Monitoring and Managing Intrusion Prevention System Using BIG-IQ
  3. Managing Intrusion Prevention System (IPS)
Manual Chapter : Managing Intrusion Prevention System (IPS)

Applies To:

Show Versions Show Versions

BIG-IQ Centralized Management

  • 7.0.0
Manual Chapter

Managing Intrusion Prevention System (IPS)

Managing inspection profiles for Network Security

In Network Security you can configure profiles to inspect traffic for protocol inspection items. These protocol inspection items can include compliance checks (which look for packet formation issues), and signatures, to detect potentially malicious packet information.
Protocol inspection items are arranged in categories by the Services (for example, HTTP, SIP, or DNS). You can assign protocol inspection items individually or in groups for your managed BIG-IP devices.
You can apply your protocol inspection profile for the following objects:
  • Profile applied to a virtual server firewall policy rule
  • Profile directly applied to a context (vip-type context)

Configuring inspection profiles in a production environment

The configuration for protocol inspection profiles has default settings, some of which might cause unexpected results when you deploy the profile in a production environment. Inspection IDs are used to identify potentially harmful traffic by identifying packets that do not conform to traffic standards (compliance checks), and known malicious payload messages (signatures). To view a full list of pre-installed inspection IDs, see the screen here:
Configuration
SECURITY
Network Security
Protocol Security
Inspection List
.
Inspection IDs have action settings that are set to
Don't Inspect
 by default. This prevents any action whatsoever against traffic detected with the specified inspection items. When settings are configured to
Reject
or
Drop
, it can cause inspection ID criteria to match valid traffic, creating false positives and impacting legitimate traffic in your environment. To eliminate the possibility of the protocol inspection profile impacting valid traffic, F5 recommends these actions:
  • Change the inspection ID action settings to Accept.
  • Set the inspection log to Yes.
  • After you deploy the protocol inspection profile, and the system processes traffic for a period of time, monitor the total hit count for each inspection ID.
  • Determine the impact to your environment by monitoring data from traffic processed through the protocol inspection profile on this screen:
    Monitoring
    DASHBOARDS
    IPS
    .

Create a protocol inspection profile

Before you can create a protocol inspection profile, your managed BIG-IP device must be running version 13.1 or later, with AFM, and must be licensed with Intrusion Detection & Prevention System.
A protocol inspection profile collects rules for protocol inspection using pre-installed signatures defined by the Snort project, or custom signatures defined using the Snort syntax. Select and add signatures to the profile by inspection service. You can narrow the scope of signatures by a number of other characteristics. You can enforce signatures, or compliance items, or both.
  1. Go to
    Configuration
    SECURITY
    Network Security
    Protocol Security
    Inspection Profiles
    .
  2. Click
    Create
    .
    Alternatively, you can clone an existing inspection profile by selecting the profile and clicking
    Clone
    .
  3. Type a
    Name
    for your profile.
  4. To enforce signatures, from
    Signatures
    , select
    Enabled
    .
    If you are enforcing only compliance items, you can select
    Disabled
     here.
  5. To enforce compliance checks, from
    Compliance,
     select
    Enabled
     .
    If you are enforcing only signature items, you can select
    Disabled
     here.
  6. To collect AVR stats, from the
    AVR Stats Collect
     list, select
    Enabled
    .
    This action allows you to monitor data for traffic managed by the inspection profile using the IPS dashboard. You must have AVR provisioned on your BIG-IP device, and your BIG-IQ configuration must include a DCD with statistics collection enabled.
  7. From the services setting, select the services you want to add to this inspection profile.
    Each selected service type displays its unique list of attack signatures and compliance checks in the Inspection Properties area.
    By default, all selected service items are enabled.
  8. Edit inspection service item settings as needed, in the Inspection Properties area.
    For services and single inspection items, you can select a port or port range. These indicate the acceptance criteria for inspecting traffic assigned to a host firewall policy or virtual server.
    1. To edit all inspection items from all services, select
      Select/Unselect All
      .
      If you enable this option,
      Edit Selected Inspections
      allows you to configure the
      Action
       and
      Log
       settings. Once you have configured these settings, click
      Set
      .
    2. To disable the status of all inspection items for a single service, click the name of the service, and select
      Disabled
      from the
      Status
      list.
      Disabling a service's status allows you to save inspection action and logging settings, without deleting your changes.
      If you would like to add logging settings to all inspections in a service, expand the service to display all inspection items, and click the box at the top left of the list to select all. Under the
      Edit All Inspection Settings
       field, you can select a log setting and click
      Set
      .
      If you have disabled the service's status, the service is crossed off in the Inspection Properties list.
    3. To edit settings for a single inspection, expand a service and click the ID link to change the action and log settings for the inspection item.
      You can perform changes for multiple inspection items by selecting box next to the inspection ID, and configuring bulk changes using the
      Edit Selected Inspections
       settings. To save your changes, click
      Set
      .
  9. To trigger a delayed action following a suggestion period, once the inspection item is detected, under Suggestions Properties, select the check box for
    Suggestion Mode
    .
    Once you select the suggestion mode, you can set either a time or a confidence level threshold for the suggestion period.
    You can configure either time or confidence level as the suggestion period threshold, but you cannot configure both. This setting is not active for BIG-IP devices running version 13.1 or later.
    1. In the
      Auto Approval Trigger
       setting, for a time suggestion period, set the number of minutes.
      The default automatic approval time is 10080 minute (7 days). You can set the time threshold from 720 to 43200 minutes.
    2. For Confidence Level, set the percentage of confidence required for the system to take automatic action.
      For inspection profiles running on BIG-IP version 14.0, you cannot set a Confidence Level.
    For inspection profiles running on BIG-IP devices 14.1 or later, there is an enabled suggestion period, by default. This means that the system will take corrective action against detected inspection items, whether or not you enabled the
    Suggestion Mode
    .
  10. To automatically download any inspection updates for the services in this profile, select the check box for
    Update Mode
    .
  11. Click
    Save & Close
    .
The Inspection Profiles screen opens and the inspection profile you created is displayed in the list. The Protocol Inspection profile must be attached to an object before you can deploy the new profile.
You can attach a protocol inspection profile to a firewall rule or to a virtual server and then deploy or pin your Protocol Inspection profile.

Edit a protocol inspection profile

You can adjust the configuration of your protocol inspection profile to improve network protection, or to mitigate known issues that can affect your network.
  1. Go to
    Configuration
    SECURITY
    Network Security
    Protocol Security
    Inspection Profiles
    .
  2. To edit an inspection profile, click the name.
    The properties screen opens for that profile.
  3. Edit the profile as needed, and click
    Save & Close
    .
    The Protocol Inspection profile list is displayed.
  4. Ensure that the edited profile is selected, and click
    Deploy
    .
The the system update the edited protocol inspection profile and automatically applies changes to the associated contexts and virtual servers.

Assign a protocol inspection profile to a virtual server

before you can assign a protocol inspection profile to a virtual server, you must have AFM licensed on the BIG-IP devices that host the virtual servers. The selected BIG-IP devices must be running version 13.1 or later.
You add a protocol inspection profile to your virtual server to detect malformed packets and malicious signatures in the traffic received by your virtual server.
  1. Go to
    Configuration
    SECURITY
    Network Security
    Contexts
    .
  2. In the name column, click the name of the relevant virtual server (with a firewall type of vip).
    This displays the properties of the selected virtual server.
  3. At the lower part of the screen, from the
    Shared Objects
     list, select
    Inspection Profiles
    .
    The list of the configured inspection profiles displays.
  4. Click the row of the inspection profile you want to add, and drag the row upto the
    Protocol Inspection Profile
     setting located in the Properties area.
  5. Click
    Save & Close
    .
    The Contexts screen opens.
  6. In the Contexts screen, ensure that the virtual server is still selected, and click
    Deploy
    .
The system enables and deploys the inspection profile on your virtual server.
You can evaluate the traffic managed by your inspection profile by using the IPS dashboard (
Monitoring
DASHBOARDS
IPS
).

Assign a protocol inspection profile to a network firewall rule

Before you can add an inspection profile, you must have an existing network firewall policy. F5 recommends that you have an existing rule set for the policy, as well.
You assign protocol inspection to a firewall rule for additional firewall protection against packet compliance issues and malicious payload signatures. Assigning protocol inspection provides an additional layer of traffic inspection in the case that all prior network rules are approved.
  1. Go to
    Configuration
    SECURITY
    Network Security
    Network Firewall
    Firewall Policies
    .
  2. Click the name of the firewall policy.
    The firewall properties screen opens to the
    RULES
     screen.
  3. From the firewall rule list, identify the firewall rule you want to add to an inspection policy.
    1. If you do not have an existing rule:
    • Click
      Create Rule
       to add a blank firewall rule. For existing child rules, you might not be able to edit the rule within the firewall policy.
    • To edit a complex rule list you can go to
      Configuration
      SECURITY
      Network Security
      Network Firewall
      Rule lists
       and select the rule you want to attach an inspection profile.
  4. For your firewall rule, select the pencil icon to the far left of the rule's row.
    This displays all fields of the rule so you can edit them.
  5. Scroll to the far right of the rule row, and select a Protocol Inspection Profile from the list under the Protocol Inspection Profile column.
  6. Click
    Save & Close
    .
    The firewall policy list is now displayed.
  7. Select the policy (or rule) and click
    Deploy
    .
This adds the inspection profile to the rule of your firewall policy. Traffic that meets the rule criteria is inspected based on the inspection profile's settings.
Now you should evaluate the traffic managed by your inspection profile by using the IPS dashboard (
Monitoring
DASHBOARDS
IPS
).

Pin a protocol inspection profile to a device

You must have a protocol inspection profile already configured before you can pin it to a device.
You can pin a protocol inspection profile to a BIG-IP device. This associates the protocol inspection profile to a designated device.
  1. Go to
    Configuration
    SECURITY
    Network Security
    Network Firewall
    Pinning Policies
    .
    The screen displays a list of the managed BIG-IP devices with AFM provisioning.
  2. Click the name of the device on which to pin a protocol inspection profile.
    The properties screen opens for that device.
  3. From the
    Network Security (AFM)
     list in the middle of the screen, select
    Inspection Profiles
    .
  4. From the list of inspection profiles, select the inspection profile you want to pin to the device.
  5. Click
    Save & Close
    .
This pins the protocol inspection profile to the device.

Monitoring IPS traffic

The protocol inspection profile provides a traffic evaluation layer that supplements the standard firewall rules that are used to manage traffic based on network configurations of traffic. Depending on your configuration, your inspection profile can prompt your system to monitor suspicious traffic, or it can drop or reject traffic based on its packet formation or payload signatures.
The IPS dashboard allows you to filter inspected traffic (matched events) by several different properties. For example: the inspection profile's host (virtual server or firewall policy), traffic properties, inspection action, or inspection service.

Identify issues with traffic managed by an inspection profile

To view IPS analytics data, you must have the following prerequisites:
  • A Data Collection Device (DCD) configured to your BIG-IQ system
  • Managed BIG-IP devices that have AFM provisioned for managing network firewall policies or Network Security contexts
  • A protocol inspection profile with enabled AVR Stats Collect, assigned to a virtual server or network firewall rule
  • Statistics collection that is enabled for the managed BIG-IP devices
Once you have configured your protocol inspection profile to detect traffic with compliance issues and known malicious signatures, you can monitor this traffic to verify the profile's configuration, or identify issues that require changes. These issues can include, but are not limited to, false positives that reject or drop valid traffic, a policy that allows traffic and requires more vigorous action, or a need for additional inspection services.
  1. Go to
    Monitoring
    DASHBOARDS
    IPS
    The screen displays the Average Matched Events chart, which represents the average events per second for all inspected traffic (over the selected time period) that have been detected across all inspection profiles configured within your managed environment. Additionally, it displays the top aspects of inspected traffic in the widgets about the charts.
  2. To detect issues based on the inspected traffic details you can view the following traffic aspects:
    1. Expand one or more of the following dimensions located in the dimensions pane to the far right of the screen:
      Countries
      ,
      Client IPs
      ,
      Destination Ports
      ,
      Network Protocols
      .
      Each expanded dimension displays objects that have been detected and their data over the selected time period.
    2. To filter displayed data, select one or more of the dimension objects.
      Each object selection filters data in the charts and dimensions to include only the data relevant to your selections.
    3. Once you have filtered required traffic characteristics, you can identify the corresponding inspection profile by expanding the
      Profile Names
       dimension.
  3. To detect issues based on the inspection profile's virtual servers:
    1. Expand the
      Virtual Servers
       dimension.
    2. Select one of the virtual servers listed in the dimension display that server's data.
      From here, you can analyze the chart data, or the tabular data in the other dimensions.
    3. Isolate the associated inspection profile, by expanding the
      Profile Names
       dimension.
      You can focus on additional aspects of the inspection items, by expanding the
      Inspection IDs
      ,
      Inspection Names
      ,
      Destination Ports
      , and
      Services
      . Details from these dimensions may assist you in the editing process of an inspection profile.
  4. To view actions against inspected traffic for a single inspection profile:
    1. Expand the
      Profile Names
       dimension.
    2. Select the profile name from the dimension list.
      This selection filters data in the charts and dimensions to include only the data relevant to your selection.
    3. Expand the
      Actions
       dimension to display how the inspected traffic was managed.
Once you have isolated any issues with your inspection profile and its performance, you can edit the profile's configuration to better suit your network's protection requirements.
Contact Support Contact Support

Have a Question?

Support and Sales >

About F5

Education

F5 Sites

Support Tasks




©2023 F5, Inc. All rights reserved.


Trademarks Policies Privacy California Privacy Do Not Sell My Personal Information