Same vulnerability profile for dns and web servers security policies

[faizankhurshid]

Hi

I am wondering, firewall does not have the option to make vulnerability protection profiles based on signature categories like vulnerability signatures for dns server and web server and then used them in security policies realted to dns only or web server only.

in firewall, I can see I have just only one vulnerability protection profile and use in all polices either its for dns or web server. Is there any performance impact for this?

[reaper]

Hi @faizankhurshid

No

The kind of application your profile touches is controlled by the security policy, but the content scanning process is the same for all your sessions. (the presense of a profile sends the packets to the content scanning engine and it will scan the session appropriately)

The security profiles control the decission making process (alert, drop, block ip, ...) but not how the applications are scanned

[faizankhurshid]

Hi @reaper

Thanks for the reply. Sorry for late for coming back to this discussion. 

So you mean, regardless of the application, the session is scanned for all vulerability signatures by content engine? Its not like if application is identified as DNS then only DNS specific sigantures are checked against the session? 

[reaper · Accepted solution]

Hi @faizankhurshid

No

The packet is handed over to the content scanning engine and it will inspect the packet as efficiently as possible, it uses protocol specific decoders, so if dns is detected it will be inspected by the dns decoder, if http is detected, it will be processed by the http decoder

[faizankhurshid]

@reaper thanks 

Just last thing, if decoder is identified as DNS then still it will inspect all vulnerability signatures right?

[reaper · Accepted solution]

yes, for dns related vulnerabilities

[faizankhurshid]

Thanks 

@reaper I also observed for the application unknown-tcp, all vulnerabilities were checked in logs like IIS realted etc

[reaper]

hi @faizankhurshid

unknown-tcp does not have a decoder (because it is unknown) so is checked for all vulnerabilities