-
Cisco Guard Configuration Guide (Software Version 6.0)
-
Index
-
Preface
-
Product Overview
-
Initializing the Guard
-
Configuring the Guard
-
Configuring Traffic Diversion
-
Configuring Zones
-
Configuring Zone Filters
-
Configuring Policy Templates and Policies
-
Learning the Zone Traffic Characteristics
-
Protecting Zones
-
Using Interactive Protect Mode
-
Using Attack Reports
-
Using Guard Diagnostics Tools
-
Performing Maintenance Tasks
-
Analyzing Guard Mitigation
-
Understanding Zone Traffic Diversion
-
Troubleshooting Diversion
-
Feedback
Table Of Contents
Learning the Zone Traffic Characteristics
Understanding the Learning Process and Related Options
Understanding the Phases of the Learning Process
Verifying the Results of the Learning Process
Understanding the Protect and Learn Function
Synchronizing the Zone Learning Process Results with a Detector
Activating the Policy Construction Phase
Activating the Threshold Tuning Phase
Configuring Learning Parameters
Configuring the Threshold Selection Method
Enabling the Protect and Learn Function
Using Snapshots to Verify the Results of the Learning Process
Copying Policies to the Zone Configuration
Learning the Zone Traffic Characteristics
This chapter describes how to use the Cisco Guard (Guard) learning process to analyze zone traffic characteristics to create and tune the policies that the Guard uses for zone protection.
This chapter refers to the Cisco Detector (Detector), the companion product of the Guard. The Detector is a Distributed Denial of Service (DDoS) attack detection device that analyzes a copy of the zone traffic. The Detector can activate the Guard attack mitigation services when the Detector determines that the zone is under attack. The Detector can also synchronize zone configurations with the Guard. For more information about the Detector, see the Cisco Traffic Anomaly Detector Module Configuration Guide and Cisco Traffic Anomaly Detector Configuration Guide.
This chapter contains the following sections:
•
Understanding the Learning Process and Related Options
•
•
•
•
•
Understanding the Learning Process and Related Options
The learning process allows the Guard to analyze normal zone traffic conditions to establish a baseline for determining when traffic is normal and when traffic contains anomalies that indicate an attack on the zone. During the learning process, the Guard creates new zone policies and modifies the policy thresholds based on the normal traffic patterns to produce the reference baseline.
To learn the zone traffic characteristics, the Guard analyzes zone traffic that is diverted from its normal network path to Guard. As the Guard analyzes the traffic, it injects the traffic back into the network. You must configure traffic diversion before initiating the learning process or divert the zone traffic to the Guard manually using an external device. You can configure zone traffic diversion using the routing configuration of the Guard. See Chapter 4, "Configuring Traffic Diversion" for more information.
Note
If there is an attack on the zone before the learning process has been completed, use on-demand protection to protect the zone if one of the following conditions apply:
•
•
•
For more information about on-demand protection, see the "Activating On-Demand Protection" section on page 9-2.
You can enter learning-related commands for several zones at the same time. Enter the command in global mode and use an asterisk (*) as a wildcard. For example, to initiate the policy construction phase for all zones, enter the learning policy-construction * command in global mode. To accept the results of the policy construction phase for all Guard zones with names that begin with scan (such as scannet and scanserver), enter the no learning scan* accept command in global mode.
This section contains the following topics:
•
•
•
•
Understanding the Phases of the Learning Process
The learning process consists of these two phases:
•
The policy templates define the types of zone policies that the Guard creates, the maximum number of services that the Guard monitors closely, and the minimum threshold that triggers the Guard to create new policies. To change the rules for constructing zone policies, you must change the policy template parameters before you initiate the policy construction phase. See Chapter 7, "Configuring Policy Templates and Policies," for more information.
Note
For more information about using the policy construction phase, see the "Activating the Policy Construction Phase" section.
•
You can activate the threshold tuning phase and zone protection simultaneously (the protect and learn function) to prevent the Guard from learning malicious traffic thresholds. You can set the Guard to constantly tune the zone policies and define the intervals in which the Guard updates the policy thresholds.
Note
For more information about using the threshold tuning phase, see the "Activating the Threshold Tuning Phase" section.
During both phases of the learning process, the Guard does not modify the current zone policies until the results of a learning phase are accepted as follows:
•
•
After the policies are created, you can add and delete policies or change policy parameters such as thresholds, services, timeouts, and actions.
Verifying the Results of the Learning Process
You can save the current results of either learning phase at any stage during the learning process and review it later by using the snapshot command. Taking a snapshot of the learning process allows you to view the policy information that the Guard has created up to the point of the snapshot and decide whether or not to accept the results of the learning process. Saving the results of the learning phase in a snapshot does not affect the zone configuration. You can update the zone configuration with the policy information in a snapshot.
For more information about using the snapshot command, see the "Creating Snapshots" section.
Understanding the Protect and Learn Function
After the Guard has performed the policy construction phase, you can activate the threshold tuning phase of the learning process and enable zone protection simultaneously using the protect and learn function. The Guard tunes the policy thresholds while monitoring the traffic for anomalies using the last saved policy thresholds. The protect and learn function enables the Guard to protect the zone, constantly update the policy thresholds based on the zone traffic characteristics, and prevents the Guard from learning malicious traffic thresholds.
Before you activate the protect and learn function, you can configure when and how the Guard accepts the results of the threshold tuning phase by configuring the learning parameters.
See the "Enabling the Protect and Learn Function" section for more information.
Synchronizing the Zone Learning Process Results with a Detector
You can configure a Detector to perform threshold tuning and to update the corresponding zone configuration on the Guard using a process called zone synchronization, For example, when you enable the detect and learn function on the Detector and it detects an anomaly, it stops the learning process, updates the Guard with the latest zone configuration using zone synchronization, and then activates the Guard's attack mitigation services. Zone synchronization enables you to use the Detector to continuously adjust the zone policy thresholds to changes in the traffic for both the Detector and the Guard. Because the Detector analyzes a copy of the zone traffic, you avoid having to constantly divert the zone traffic to the Guard for the learning process.
Note
To synchronize the Detector learning process results with the Guard, you must perform the following tasks:
1.
2.
Create the zone on the Detector using a Guard zone template.You can synchronize the zone configuration with the Detector manually or configure the Detector to synchronize the zone configuration with the Guard automatically. See the "Synchronizing Zone Configurations with a Detector" section on page 5-8 for more information.
Activating the Policy Construction Phase
Use the policy construction phase of the learning process after creating a new zone or any time that the zone configuration needs updating with new service policies. When you enable the policy construction phase, the Guard diverts the zone traffic from the traffic's normal network path so that the traffic flows through the Guard, enabling it to discover the main services (ports and protocols) that the zone uses. The Guard creates the zone policies using the rules established by the policy templates.
Note
The new policies that the Guard creates during the policy construction phase replace the existing policies when you accept the results of the phase.
Note
Caution
To activate the policy construction phase of the learning process, perform the following steps:
Step 1
learning policy-constructionStep 2
Wait at least 10 seconds after initiating policy construction or threshold tuning and enter the show rates details command. Verify that the value of the Received traffic rate is greater than zero. A value of zero indicates a diversion problem.
Step 3
You can save a snapshot of the learning parameters (services, thresholds, and other policy-related data) by using the snapshot command at any stage during the policy construction phase, and review it later. You can save a single snapshot or save a periodic snapshot at specified intervals.
For more information, see the "Backing Up the Policy Configuration" section on page 7-24.
Step 4
To accept the policies that the Guard suggested and continue the policy construction phase, use the following command:
learning acceptTo automatically accept the policies that the Guard suggests at specified intervals, use the following command:
learning-params periodic-action auto-accept learn_params_days learn_params_hours learn_params_minutesSee the "Configuring Learning Parameters" section for more information.
Use the no learning-params periodic-action command to terminate the periodic action.
Step 5
Note
You can perform one of the following actions:
•
no learning acceptThe Guard erases previously learned policies and thresholds.
After accepting the newly constructed policies, you can manually add or remove policies. See Chapter 7, "Configuring Policy Templates and Policies," for more information.
•
no learning rejectThe Guard stops the policy construction phase and makes no changes to the current policies. The policies of the zone are the policies that the Guard had prior to initiating the learning process or prior to the last time that you accepted the results of the policy construction phase.
After performing the policy construction phase, enable the threshold tuning phase to tune the thresholds of each policy (see the "Activating the Threshold Tuning Phase" section).
The following example shows how to initiate the policy construction phase and accept the suggested policies at 12-hour intervals. The example also shows how to stop the policy construction phase and accept the suggested policies.
user@GUARD-conf-zone-scannet# learning policy-constructionuser@GUARD-conf-zone-scannet# learning-params periodic-action auto-accept 0 12 0user@GUARD-conf-zone-scannet# no learning acceptActivating the Threshold Tuning Phase
Use the threshold tuning phase to enable the Guard to analyze the zone traffic and define thresholds for the zone policies. We recommend that you run the threshold tuning phase during peak traffic time (the busiest part of the day) for a minimum of 24 hours to allow the Guard enough time to properly tune the policy thresholds. However, if the Guard is constantly diverting the zone traffic, you should keep the protect and learn function active and do not terminate the threshold tuning phase.
Note
To activate the threshold tuning phase of the learning process, perform the following steps:
Step 1
•
•
Note
•
•
Step 2
Step 3
Step 4
To accept the thresholds that the Guard suggested and continue the threshold tuning phase, use the following command:
learning accept [threshold-selection {new-thresholds | max-thresholds | weighted weight}]See Table 8-2 for a description of the threshold-selection arguments and keywords.
To automatically accept the thresholds that the Guard suggests at specified intervals, use the following command:
learning-params periodic-action auto-accept learn_params_days learn_params_hours learn_params_minutesSee the "Configuring Learning Parameters" section for more information.
Use the no learning-params periodic-action command to terminate the periodic action.
Step 5
Note
Perform one of the following actions:
•
no learning accept [threshold-selection {new-thresholds | max-thresholds | weighted weight}]See Table 8-2 for a description of the threshold-selection arguments and keywords.
The Guard replaces the previously learned thresholds with the new thresholds. After accepting the newly tuned policies, you can manually change the policy parameters. See Chapter 7, "Configuring Policy Templates and Policies," for more information.
•
–
The Guard stops tuning the thresholds and makes no changes to the current thresholds. This process may result in a situation in which new zone policies have thresholds that were obtained based on past traffic characteristics. We recommend that you enable the threshold tuning phase at a later time or that you configure the thresholds manually.
–
If you have the protect and learn function enabled, use the deactivate command to terminate zone protection and the threshold tuning phase without saving the current suggested thresholds.
The following example shows how to initiate the threshold tuning phase and accept the suggested policies at 1-hour intervals. The Guard then stops the threshold tuning phase and accepts the suggested policies if the threshold values are higher than the current values (the max-thresholds method).
user@GUARD-conf-zone-scannet# learning threshold-tuninguser@GUARD-conf-zone-scannet# learning-params periodic-action auto-accept 0 1 0user@GUARD-conf-zone-scannet# no learning accept threshold-selection max-thresholdsAfter performing the threshold tuning phase, you can perform the following tasks:
•
•
•
•
Configuring Learning Parameters
This section shows how to configure the learning parameters to manage the following functions that affect all of the zone policies:
•
•
•
To display the current configuration of the learning parameters, use the show learning-params command in zone configuration mode.
This section contains the following topics:
•
•
Configuring Periodic Actions
You can configure the Guard to perform one of the following actions at specified intervals:
•
•
See the "Verifying the Results of the Learning Process" section for more information about snapshots.
To set the periodic action that the Guard performs, use the following command in zone configuration mode:
learning-params periodic-action {auto-accept | snapshot-only} learn_params_days learn_params_hours learn_params_minutes
Table 8-1 provides the arguments and keywords for the learning-params command.
The value of the interval is the sum of the learn_params_days value, the learn_params_hours value, and the learn_params_minutes value.
The following example shows how to set the Guard to accept the policies at 1-hour intervals:
user@GUARD-conf-zone-scannet# learning-params periodic-action auto-accept 0 1 0Configuring the Threshold Selection Method
You can define the default method that the Guard uses to generate new thresholds to accept during the threshold tuning phase. You can accept the results of the threshold tuning phase manually, or configure the Guard to automatically accept the results of the threshold tuning phase at specified intervals.
To configure the threshold selection method, use the following command in zone configuration mode:
learning-params threshold-selection {new-thresholds | max-thresholds | weighted weight}
Table 8-2 provides the arguments and keywords for the learning-params threshold-selection command.
This example shows how to configure the Guard to accept the suggested policies if the learned threshold values are higher than the current policy threshold values:
user@GUARD-conf-zone-scannet# learning-params threshold-selection max-thresholdsMarking the Policies as Tuned
The Guard marks the policy threshold status that defines if the policy thresholds are tuned or not and relates to this status when you enable the protect and learn function. The policy threshold status specifies if the Guard identifies an attack on the zone when the policy threshold is exceeded.
When a new zone is created, or after you accept the policy construction phase results for a zone, the Guard marks the zone policy thresholds as untuned. The default thresholds of the zone templates are tuned so that the Guard activates the anti-spoofing functions quickly if it identifies traffic anomalies in the zone traffic. When you enable the protect and learn function, the learning process might stop if the current zone traffic is higher than the current policy threshold values. To avoid such situations, if the zone policies are not tuned, the Guard does not detect attacks in the zone traffic when you enable the protect and learn function until the zone policy thresholds are accepted once.
If the zone policies are untuned, the Guard activates only a threshold selection method of accept-new and ignores previous threshold values when accepting the new policies. If the Guard accepts the threshold tuning phase results of the learning process for a zone with a threshold selection method other than accept-new, bad policy threshold values may result. See the "Configuring the Threshold Selection Method" section for more information about the threshold selection method.
The Guard marks the zone policies as untuned in the following situations:
•
•
•
The Guard marks the zone policies as tuned after accepting the threshold tuning phase results.
You can modify the settings of the zone policies. To mark the zone policies as tuned, use the following command in zone configuration mode:
learning-params threshold-tuned
To mark the zone policies as untuned, use the no form of this command.
You may want to change the status of the zone policies to tuned when one of the following applies:
•
•
You may want to change the status of the zone policies to untuned when one of the following applies:
•
•
•
When the zone policies are marked as untuned, the Guard does not monitor the current policy thresholds and does not detect attacks on the zone if the policy thresholds are exceeded.
Caution
The following example shows how to mark the status of the zone policies as tuned:
user@GUARD-conf-zone-scannet# learning-params threshold-tunedEnabling the Protect and Learn Function
You can enable the threshold tuning phase of the learning process and zone protection simultaneously by using the protect and learn function. The Guard continuously tunes the policy thresholds and at the same time monitors the traffic for anomalies using the last saved policy thresholds. If the Guard detects an attack on the zone, it stops the learning process to prevent it from learning malicious traffic thresholds and begins mitigating the attack. After the attack ends, the Guard resumes the threshold tuning phase along with zone protection.
Perform the following actions before you activate the protect and learn function:
•
•
Caution
If the policies are untuned when you enable the protect and learn function, the Guard operates as follows:
–
–
See the "Marking the Policies as Tuned" section for more information.
You can accept the results of the threshold tuning phase manually or configure the Guard to accept the results automatically. You can also configure when and how the Guard accepts the results of the learning process (see the "Configuring Learning Parameters" section).
To activate the learning process and zone protection simultaneously, use the protect learning command or enter both the learning threshold-tuning command and the protect command (the order is not important).
For more information about the threshold tuning phase, see the "Activating the Threshold Tuning Phase" section. For more information about enabling zone protection, see Chapter 9, "Protecting Zones."
Using Snapshots to Verify the Results of the Learning Process
The snapshot function allows you to save a copy of the learning parameters (services, thresholds, and other policy-related data) at any stage of the learning process. You can use snapshots to perform the following tasks:
•
•
•
•
We recommend that you save a snapshot every few hours during the learning process. You can take the snapshot manually or configure the Guard to automatically take a snapshot at specified intervals. The Guard can save up to 100 snapshots for each zone. New snapshots replace the previous ones.
This section contains the following topics:
•
Creating Snapshots
You can save a single snapshot of the zone learning parameters or configure the Guard to automatically take a snapshot at specified intervals. The Guard continues the learning process while taking the snapshot.
To configure the Guard to automatically take a snapshot at specified intervals, see the "Configuring Periodic Actions" section for more information.
To save a single snapshot of the zone learning parameters, use the following command in zone configuration mode:
snapshot [threshold-selection {cur-thresholds | max-thresholds | new-thresholds | weighted calc-weight}]
Table 8-3 provides the arguments and keywords for the snapshot command.
The following example shows how to create a snapshot in which the thresholds are the highest value between the current policy threshold and the new threshold of the learning process:
user@GUARD-conf-zone-scannet# snapshot threshold-selection max-thresholdsTo save a single snapshot in global mode, use the following command:
snapshot zone-name [threshold-selection {new-thresholds | max-thresholds | cur-thresholds | weighted weight}]
Comparing Learning Results
You can compare the learning results of two snapshots or two zones to trace the differences in policies, services, and thresholds.
This section contains the following topics:
Comparing Snapshots
To compare two snapshots, use the following command in zone configuration mode:
diff snapshots snapshot-id1 snapshot-id2 [percent]
Table 8-4 provides the arguments for the diff command.
The following example shows how to display the zone snapshots and compare the two most recent snapshots:
user@GUARD-conf-zone-scannet# show snapshotsID Time1 Feb 10 10:32:042 Feb 10 10:49:123 Feb 10 11:01:50user@GUARD-conf-zone-scannet# diff 2 3To compare snapshots in global mode, use the following command:
diff zone-name snapshots snapshot-id1 snapshot-id2 [percent]
Comparing Zones
You can compare the learning parameters of two zones by using the following command in global mode or in configuration mode:
diff zone-name1 zone-name2 [percent]
Table 8-5 provides the arguments for the diff command.
The following example shows how to compare the learning parameters of two zones:
user@GUARD# diff scannet scannet-mailserverDisplaying Snapshots
You can display a list of the zone snapshots or the snapshot parameters to get a comprehensive view of the zone learning results by entering the following command in zone configuration mode:
show snapshots [snapshot-id [policies policy-path]]
Table 8-6 provides the arguments and keywords for the show snapshots command.
Table 8-6 Arguments and Keywords for the show snapshots Command
snapshot-id
(Optional) Identifier of the snapshot to display. If you do not specify policies, the default is to display a list of all the zone snapshots. To view the snapshot ID, use this command with no arguments.
policies policy-path
(Optional) Specifies a group of policies to display. See the "Understanding Zone Policies" section on page 7-1 for more information.
To compare snapshots in global mode, use the the following command:
show zone zone-name snapshots [snapshot-id [policies policy-path]]
The fields of the show zone zone-name snapshots snapshot-id policies policy-path command output are identical to the fields in the output of the show policies command. See the "Displaying Policies" section on page 7-21 for more information.
Table 8-7 describes the fields in the show snapshots command output.
Table 8-7 Field Descriptions for show snapshots Command Output
Snapshot identifier.
Date and time that the snapshot was taken.
The following example shows how to display a list of the zone snapshots and the policies that are related to dns_tcp in snapshot 2:
user@GUARD-conf-zone-scannet# show snapshotsID Time1 Feb 10 10:32:042 Feb 10 10:49:12user@GUARD-conf-zone-scannet# show snapshots 2 policies dns_tcpDeleting Snapshots
You can delete old snapshots to free disk space by using the following command in zone configuration mode:
no snapshot snapshot-id
The snapshot-id argument specifies the identifier of an existing snapshot. Enter an asterisk (*) to delete all the zone snapshots. To view the details of a snapshot, use the show snapshots command.
The following example shows how to delete all the zone snapshots:
user@GUARD-conf-zone-scannet# no snapshot *Copying Policies to the Zone Configuration
You can copy a complete policy configuration or a partial configuration to the current zone.
You can copy the following information:
•
•
To copy the zone policies, use the following command in zone configuration mode:
copy-policies {snapshot-id | src-zone-name [service-path]}
Table 8-8 provides the arguments for the copy-policies command.
The following example shows how to copy all services that relate to the policy template tcp_connections from the zone webnet to the current zone, scannet:
user@GUARD-conf-zone-scannet# copy-policies webnet tcp_connections/The following example shows how to display a list of the zone snapshots and then copy the policies from the snapshot with ID 2:
user@GUARD-conf-zone-scannet# show snapshotsID Time1 Feb 10 10:32:042 Feb 10 10:49:12user@GUARD-conf-zone-scannet# copy-policies 2Backing Up the Zone Policies
You can create a backup the current zone policies at any time by using the following command in zone configuration mode:
snapshot threshold-selection cur-thresholds
The following example shows how to back up the current zone policies:
user@GUARD-conf-zone-scannet# snapshot threshold-selection cur-thresholds
