topic Re: Same vulnerability profile for dns and web servers security policies in General Topics

Same vulnerability profile for dns and web servers security policies

faizankhurshid — Sun, 25 Feb 2018 14:25:16 GMT

I am wondering, firewall does not have the option to make vulnerability protection profiles based on signature categories like vulnerability signatures for dns server and web server and then used them in security policies realted to dns only or web server only.

in firewall, I can see I have just only one vulnerability protection profile and use in all polices either its for dns or web server. Is there any performance impact for this?

Re: Same vulnerability profile for dns and web servers security policies

reaper — Mon, 26 Feb 2018 09:39:08 GMT

Hi @faizankhurshid

The kind of application your profile touches is controlled by the security policy, but the content scanning process is the same for all your sessions. (the presense of a profile sends the packets to the content scanning engine and it will scan the session appropriately)

The security profiles control the decission making process (alert, drop, block ip, ...) but not how the applications are scanned

Re: Same vulnerability profile for dns and web servers security policies

faizankhurshid — Fri, 16 Mar 2018 07:31:41 GMT

Hi @reaper

Thanks for the reply. Sorry for late for coming back to this discussion.

So you mean, regardless of the application, the session is scanned for all vulerability signatures by content engine? Its not like if application is identified as DNS then only DNS specific sigantures are checked against the session?

Re: Same vulnerability profile for dns and web servers security policies

reaper — Fri, 16 Mar 2018 08:05:41 GMT

Hi @faizankhurshid

The packet is handed over to the content scanning engine and it will inspect the packet as efficiently as possible, it uses protocol specific decoders, so if dns is detected it will be inspected by the dns decoder, if http is detected, it will be processed by the http decoder

Re: Same vulnerability profile for dns and web servers security policies

faizankhurshid — Sat, 17 Mar 2018 08:04:11 GMT

@reaper thanks

Just last thing, if decoder is identified as DNS then still it will inspect all vulnerability signatures right?

Re: Same vulnerability profile for dns and web servers security policies

reaper — Mon, 19 Mar 2018 10:09:31 GMT

yes, for dns related vulnerabilities

Re: Same vulnerability profile for dns and web servers security policies

faizankhurshid — Mon, 26 Mar 2018 07:49:09 GMT

Thanks

@reaper I also observed for the application unknown-tcp, all vulnerabilities were checked in logs like IIS realted etc

Re: Same vulnerability profile for dns and web servers security policies

reaper — Mon, 26 Mar 2018 09:30:22 GMT

hi @faizankhurshid

unknown-tcp does not have a decoder (because it is unknown) so is checked for all vulnerabilities