ADVANCED FUNCTIONALITY & TROUBLESHOOTING

Page 2 Agenda Internet Shield Architecture Advanced functionality IDS vs. packet filter Stateful packet filters Dynamic firewall rules Cisco Network Admission Control (NAC) Troubleshooting Troubleshooting Internet Shield configurations Inspecting logfiles

PROCESSES AND SERVICES

Page 4 AVCS Processes F-Secure Management Agent fameh32.exe, fch32.exe, fsih32.exe, fsnrb32.exe, fsm32.exe, fsma32.exe, fsmb32.exe, fsguidll.exe F-Secure Virus & Spy Protection fsav32.exe, fsaw.exe, fsgk32.exe, fsgk32st.exe, fsdfwd.exe, fsqh.exe, fsrw.exe, fssm32.exe F-Secure Automatic Update Agent fsbwsys.exe, F-Secure Automatic Update.exe

Page 5 Processes: FSMA fsm32.exe F-Secure Manager, displays the F- tray icon fsma32.exe F-Secure Management Agent (Service) fsmb32.exe Message Broker, processes communication between the different modules of the various products fsnrb32.exe Handles the communication between the hosts and the PMS fameh32.exe Alert and Messaging Handler, handles alert and log forwarding fch32.exe Configuration Handler, reads the base policy files and writes the incremental policy files fsih32.exe Installation Handler. Launches ilaunchr.exe during installations

Page 6 Processes: Virus & Spy Protection fsav32.exe Anti-Virus Handler fsaw.exe F-Secure Ad-Watch (Browser Control) fsdfwd.exe Anti-Virus Firewall Daemon. Redirects s to the Scanner Manager (Service) fsqh.exe Handles object quarantine fsgk32.exe Gatekeeper Handler. Receives real-time scan requests from the Gatekeeper fsgk32st.exe Gatekeeper Handler Starter (Service) fsrw.exe F-Secure Reg-Watch (System Control) fssm32.exe Scanner Manager. Manages scanning engines

Page 7 Virus & Spy Protection Services F-Secure Management Agent Environment NET STOP/START FSMA: fameh32.exe, fsaw.exe, fch32.exe, fsih32.exe, fnrb32.exe, fsm32.exe, fsma32.exe, fsmb32.exe, fsdfwd.exe, fsrw.exe, fsguidll.exe F-Secure Gatekeeper Environment NET STOP/START FSGKHS: fsgk32.exe, fsgk32st.exe, fssm32.exe F-Secure Automatic Update Environment NET STOP/START FSBWSYS: fsbwsys.exe, F-Secure Automatic Update.exe

INTERNET SHIELD ARCHITECTURE

Page 9 Product Components Services Kernel Firewall Engine Firewall Daemon Management Agent (FSMA) Scanning Module Desktop User Interfaces F-Secure Manager Firewall Plug-ins Dial-up Control API Hook Packet FilterIDS Interceptor

Page 10 Firewall Engine Fsdfw.sys Kernel mode component Firewall engine does the actual filtering based on rules Intrusion detection, packet filtering and application control are all done in Firewall Engine IDS handles the packets before packet filter TDI Driver is taking care of connection request filtering / checking which is needed for application control TCP "listen", TCP "connect", UDP "listen", UDP "sendto", RAWIP "create“

Page 11 Interceptor Fsndis5.sys Kernel mode component Loaded by Firewall Engine (fsdfw.sys) Intercepting network traffic in the NDIS layer Main purpose is to hook the network traffic and forward it to firewall engine

Page 12 Fsdc.dll DC hooking DLL is injected into the dialer process. RAS API calls are redirected to the DC hooking DLL Allow or deny decision comes through policy (whitelist) or through user decision (prompt) Dial-up Control API Hooking

Page 13 Firewall Daemon Fsdfwd.exe User mode component Receives alerts and status information directly from firewall engine Reads everything from policy tables Reads connection information received from TDI Driver Receives dial requests from the DC DLL and makes the decision to allow or deny the operation Sends firewall rules (filter) and IDS database to firewall engine Writes ACTION.LOG and DIAL.LOG

Page 14 Firewall Plug-in Fsdfwpi.dll User lnterface component IS Plug-in for F-Secure Manager (fsm32.exe) Displays dialogs to the end user (note: static firewall settings are handled by the AV main & advanced GUI)

ADVANCED FUNCTIONALITY IDS VS. PACKET FILTER

Page 16 Packet Filter Limitations Intrusion Detection Systems are becoming more and more popular Packet filters aren’t enough to secure the corporate networks While a firewall closes all unused ports, it cannot protect you from intentionally left open ports Closing all ports would affect the corporation’s operational requirements Example: A corporation leaves open TCP 80, so that HTTP traffic can reach the web server How can the firewall then protect the network against the countless HTTP based exploits This is where IDS comes in…

Page 17 The Anti-Virus for your Network… Basically, IDS does for your network what Anti-Virus does for your file system IDS Solutions Signature based engines Pre-defined patterns tell the system, what type of network traffic most commonly correspond to an attack Heuristic engines The IDS learns over time, what patterns are considered normal for your network Pro: Doesn’t rely on signatures, able to detect unknown patterns Contra: Increasing number of false positives

Page 18 Intrusion Detection System (IDS) IDS engine is divided in 3 parts Generic IP engine UDP protocol engine TCP protocol engine The system currently alerts on 31 malicous packets (13 IP, 5 UDP, 13 TCP) Database selected carefully to avoid false positives

Page 19 Firewall Engine Was that Really a Network Worm? Worm traffic Normal traffic Header Payload => TCP None IDS Packet Filter Header Payload => TCP Worm 1 2

STATEFUL PACKET FILTERS

Page 21 Stateful Packet Filter The firewall keeps a log of all open connections and the current state of all active connections Maintains a database of allowed and active IP based connections Uses the connection database to check if the datagram is part of an accepted connection Works for all IP Protocols (most common TCP, UDP and ICMP)

Page 22 Echo Outbound (Ping): Static Filter Following packet filter rules are needed Outbound: allow echo (Protocol: ICMP, Type: 8) Inbound: allow echo reply (Protocol: ICMP, Type: 0) Host B Responder Host A InitiatorEcho Echo Reply

Page 23 Host B Responder Host A InitiatorEcho Echo Outbound (Ping): Stateful Filter Following packet filter rules are needed Outbound: allow echo (Protocol: ICMP, Type: 8) Echo Reply Listen ICMP, 0

APPLICATION CONTROL DYNAMIC FIREWALL RULES

Page 25 The Internet Shield stateful packet filter works with two kinds of rules types Static rules Included in the pre-defined security levels or created by administrators Applied to domains or host via security levels (on PMC), always valid! Dynamic rules Created on the host at application launch (not related to security levels) Valid as long as the process is running Created only for server network applications opening a listening connection Static Rules vs. Dynamic Rules

Page 26 Dynamic Firewall Rules Where to check them...? Dynamic firewall rules can only be viewed in the Policy Manager Console There is no reporting of such rules back to the Policy Manager Server The rules can be viewed from the local advanced user interface or in specific logfiles (fulldiag.htm) Static Rules Dynamic Rules

Page 27 Firewall Dynamic Rules Placement Dynamic firewall rules are placed between the second last packet filter rule and the deny all rule The catch rule is not blocking inbound traffic, which matches one of many dynamic listening rules! Block unwanted inbound traffic with specific static rules!

Page 28 Firewall Dynamic Rules Operation Host A Host B POP3 Server X Host C Listen TCP 110 <= /

CISCO NETWORK ADMISSION CONTROL

Page 30 NAC is built from components of Cisco and various third party vendors (e.g. F-Secure) Cisco components Cisco Trust Agent (CTA) Cisco IOS Network Access Device (NAD) Access Control Server (ACS) F-Secure components Policy Manager Console Cisco NAC support plug-in CTA FS Plug-in ACS NAD System Components

Page 31 Cisco Trust Agent (CTA) One of the core components of the NAC system Must be installed on each client, whose policy state is to be validated before permitting network access Can be rolled out with PMC Checks Anti-Virus Client Security for the following posture validation attributes

Page 32 F-Secure Plug-in for Cisco NAC Used by the Cisco Trust Agent, when checking the posture validation attributes of Anti-Virus Client Security Posture validation attributes are Virus definitions update status Real-time scanning protection status Firewall protection status Installed at the same time as CTA is installed Intelligent or policy based installation with PMC

Page 33 Cisco Network Access Device (NAD) The NAD permits or denies network access Begins the client posture validation Typically a Cisco router

Page 34 Cisco Access Control Server (ACS) ACS is responsible for obtaining and evaluating the posture validation attributes Determines the overall system posture Provides the appropriate network access policy to the NAD, based on the system posture ACS configuration example Healthy: Full network access granted Checkup: Outdated virus definitions => usually no access restrictions Quarantine: Outdated virus definitions during outbreak => access restrictions Unknown: No Cisco Trust Agent installed => access restrictions

TROUBLESHOOTING

Page 36 Typical Connection Problems Application Level (Application connection control) Application was by mistake denied from establishing connections Acting as client (e.g. Internet Explorer) Acting as server (e.g. nslookup) Firewall Level (NDIS Layer) Firewall blocks or allows all or certain connections Second Firewall is installed (e.g XP firewall, overblocking traffic) Firewall allows certain traffic, even though you have no specific allow rules Remember the Application Control dynamic rules Create specific static deny rules (or use pre-defined security levels)

Page 37 Analyzing Internet Shield Problems Recommended ways to analyze Internet Shield problems are 1.Locally: Using the AVCS user interface 2.Remotely: Using Internet Shield web interface or console 12

Page 38 Local Troubleshooting Firewall Rules Static rules (outbound and inbound) Any rules blocking traffic? Any rules allowing unnecessary inbound traffic? Dynamic rules Any applications running, which allow unwanted inbound traffic?

Page 39 Local Troubleshooting Firewall Settings Trusted Interface Make sure that this setting is locked (PMC => Advanced interface) If adapters are trusted, all traffic passes unfiltered! Suspicious traffic alerting Don’t enable alerting of illegal packets (will create unnecessary alerts, increasing the size of your commdir) Can be used for debugging purposes on specific hosts

Page 40 Local Troubleshooting Application Control Rules Application Connection Control list Listing all connection rules Separate row for server and client applications To avoid wrong user decisions, configure Application Control as follows First create a detailed application list (using test computers) After that, deny all new, unknown connections (client and server applications!)

Page 41 Two main log files Action log; All firewall actions Packet log; All packets (header + payload) Local Troubleshooting Main Logfiles

Page 42 Remote Troubleshooting Internet Shield Web Interface HTTP interface, providing you with the following information Firewall Rules Active security level FW rules (grey: enabled, white: disabled) Services Pre-defined and custom services Firewall alerts Including detailed information All information seen in the web interface is in real-time! Compared to the console, where you always have a certain delay

Page 43 Example: Remote Troubleshooting Remote administration often works best when combining different tools Problem: Security Level on host doesn’t change (eventhough setting is final and forced down) Using remote web interface tells you the current active level Solution: Currently selected security level is not enabled, therefore even forcing setting change doesn’t work Enable it and distribute the policies

Page 44 Testing Firewall Configurations Problem: You don’t know if the security level holds up against different kind of network attacks Select a host which currently has the security level in question active Run a full portscan (e.g. using nmap portscan tool) Only target that specific host Never run portscans in production networks! (unless you are responsible for the network)

Page 45 Example: RPC Port Scan Portscan Tool: nmap (available at Type of scan: RPC scan (Remote Procedure Call related ports) Security Level: Custom (no static rules, active dynamic rules!)

Page 46 F-Secure Diagnostics Tool FSDIAG.EXE Diagnostics tool included in the installation package Collects important system information (eg. logfiles) to an archive on the local disk Access points C:\Program Files\F-Secure\Common\ fsdiag.exe Fsdiag.tar.gz in the same directory

Page 47 Analyzing FSDIAG System information osver.log hardware.log netstart.log system.evt Network information ipconfig.log route.log Conflicting Software appliation.evt reg_run.log AVCS internal alerts logfile.log Firewall overview fulldiag.htm Virus definitions update information header.ini daas.log

Page 48 Summary Internet Shield Architecture Advanced functionality IDS vs. packet filter Stateful packet filters Dynamic firewall rules Cisco Network Admission Control (NAC) Troubleshooting Troubleshooting Internet Shield configurations Inspecting logfiles