Understanding Master Blocking
Understanding Master Blocking
In some network architectures, for reasons such as
redundancy or perhaps cost, another ISP may be a feasible solution. An Extranet
connection or two may also be present. These connections create multiple
entryways to our network and thus generate more risk areas that will need to be
monitored.
This is where a feature called master blocking comes in. Master
blocking allows one sensor to perform the blocking for another. In a nutshell,
one sensor learns of a triggered alarm and updates the triggering router with a
new ACL. After the ACL has been updated, the sensor will communicate with any
other sensors on the network that are configured for master
blocking. The communication will take the form of a Telnet session request.
At this point, the initializing sensor becomes the blocking
forwarding sensor.
The contacted master blocking sensor(s) will
accept the Telnet connection and update any of their respective network devices
with the same ACL to keep the intruding data from entering the network via
another path.
In Figure 8.4, we see how this process works.
Let's follow the steps taken when a malicious user attempts to
access resources on a private network.
-
The malicious user connects through the Internet to ISP ABC.
From this point, he has somehow (perhaps by brute force attack) accessed the
internal network.
-
The Cisco Secure IDS Sensor1 has noticed the strange traffic
on the network and just so happens to match one of the signatures it has been
configured to monitor. This could possibly be a brute force attack on an
internal system.
-
Sensor1 creates and sends a new ACL to the perimeter router,
Router1. This action stops the attack in its place.
-
Now, with master blocking configured,
Sensor1 requests all sensors listed within its Master Blocking Sensors panel, in
this case Sensor2, to block for this same attack. Meanwhile, the attacker now
tries to reroute his traffic to any other available interface to the network. If
the attacker is prepared, the entry point via ISP XYZ will already be known.
Therefore, the attack is attempted to continue through this
other interface.
-
Sensor2 sends the ACL it received from Sensor1 to Router2
and blocks the traffic at this entry point as well.
In a nutshell, Sensor2 was completely unaware of the attack
on Router1 until Sensor1 contacted it. This saves our sensor's resources from
having to detect the same traffic over and over again and, most importantly,
stops the traffic from entering again.
196 times read
|
|
|
Did you enjoy this article?
(total 0 votes)
|
Sections
Comments (0 posted)
Syndication
