Implementing Network based Intrusion Detection with CISCO IOS

Network Intrusion Detection provides perimeter security to networks over and above policy based firewall protection. A Network based Intrusion Detection System (NIDS) is placed at strategic points in the network to protect it against internal as well as external threats. Commonly used NIDS are dedicated hardware sensors or software implementations that detect attacks based on signatures or profiles. While signature based systems compare incoming traffic to a list of signatures, profile based systems look for anomalies in traffic patterns and statistics. SNORT is a free IDS software. NetProwler from Symantec, RealSecure from ISS, NFR are some other intrusion detection systems. CISCO offers 4200 series hardware based IDS and PIX Firewalls for intrusion detection. However each of these systems add another entity to the network inventory. In this article we explain the implementation of an NIDS using the existing IOS running on CISCO routers.

CISCO routers with IOS Firewall feature set provide IDS functionality. The IOS based IDS enables network administrators of small enterprises to build intrusion detection into the network without investing in a dedicated IDS entity. This feature provides the administrators with a cost effective method of implementing IDS. The system presently provides protection against 100 most common threats. Version prior to 12.2<15>T supported only 59 signatures. The system scans all incoming and outgoing packets for malicious signatures and takes corresponding action. The system can be configured to drop the packet, reset the connection, alert the administrator via mail/SMS or send a notification to the syslog server.

Configuration
IDS functionality is disabled by default in CISCO routers. The following steps describe the initialization and configuration of IDS feature.
Initialization
router(config)# ip audit po max-events
Limits the no of queued up events. can range from 1-65535 (default is 250)
router(config)# ip audit smtp spam
Limits email spamming by limiting the recipients. can range from 1-65535 (default is 250)
1. Logging
Logging can be done using syslog or IDS Director. Syslog is the common mode of logging. However, the configuration steps for both the modes of logging are indicated below:
a) Using syslog
router(config)# ip audit notify log
router(config)# logging console info
This will send logs to router's console

b) Using IDS Director
This uses CISCO's proprietary protocol PostOffice. In this protocol, each device has a unique, user defined, host id and organization id, which identify the device. The IDs can range from 1-65535 and are similar to a host ID and network ID in the IP addressing schema.
router(config)# ip audit notify nr-director
Enables logging of IDS events to IDS Director
router(config)# ip audit po local hostid orgid
Specifies PostOffice configuration for router
router(config)# ip audit po remote host id orgid rmtaddress localaddress
Specifies configuration for remote Director device.
2. Audit Rule configuration
IDS audit rules can either be Global or specific. Global policies define default rules when no specific rule has been defined.
Global policies define default actions if no specific rules are specified.
router(config)# ip audit info {alarm }
router(config)# ip audit attack {alarm }
Default action is alarm
Specific policies can be added in addition to the global rules. They are needed if two or more interfaces on the router need different policies.
router(config)# ip audit name {info|attack}

{action }
is a name given to the policy. Specifying standard ACL in list is optional and is generally avoided as it affects router performance.
3. Signature Policies
By default all signatures are enabled.
Specific signatures can be disabled with the following command:
router(config)# ip audit signature
{disable | list }
is the list of signatures numbers to be disabled.
4. Protection policies
router(config)# ip audit po protected
ip_address1 to ip_addess2 specifies the range of ip addresses that router identifies as internal addresses. These addresses are prefixed by IN as the locator, in the alerts generated.
5. Policy activation
The defined policies need to be activated on an interface.
router(config)# interface type
router(config)# ip audit in/out specify whether the policy is to be applied to inbound or outbound traffic.
6. IDS verification
IDS configuration can be tested with the following command:
router(config)# show ip audit all
Working with Cisco IOS
We now explain the implementation with a specific example, using syslog as the logging method:
router(config)# ip audit po max-events 100
router(config)# ip audit smtp spam 250
router(config)# ip audit notify log
router(config)# ip audit name test_audit info
action alarm
router(config)# ip audit name test_audit attack
action alarm drop reset
router(config)# ip audit signature 2000 disable
router(config)# interface GiganitEthernet1
router(config-if)# ip audit test_audit in
In this example, informational signatures have been enabled and trigger an alarm. In case an attack signature matches action is alarm, drop and reset. The audit policy is applied to incoming traffic on the GigabitEthernet1 interface of the router. Signature 2000 for echo reply is disabled.
Note: It is recommended that in addition to 2000(echo reply), signatures 2001(host unreachable), 2002(source quench), 2004(echo request), 2005(time exceeded) and 6051(DNS zone transfers) be disabled as they are normal events are can generate a lot of false alarms.
The configuration can be verified using show ip
audit all command. Sample output of this command is
as follows:
Event notification through syslog is enabled
Event notification through Net Director is disabled
Default action for info signatures is alarm
Action for attack signatures is alarm drop reset
Default threshold of recipients for spam signature
is 250
Audit Rule Configuration
Audit name test_audit
attack actions alarm drop reset
Interface Configuration
Interface GigabitEthernet1
Inbound IDS audit rule is audit_ids
attack actions alarm drop reset
Outgoing IDS audit rule is not set
Limitations in security
The CISCO IOS IDS is not a full-fledged IDS, hence functionality is limited to only 100 signatures. In addition to this, since the detection is performed inline, performance of the router may be affected due to the overhead of examining the packets.

Conclusion
Though the IOS based NIDS functionality is not a
match to a dedicated, real time enterprise level
intrusion detection system, it is a boon for small enterprise network managers who can achieve added network level protection without adding another device to the network.

Box:
Applies to: Network Administrators
Price: Bundled with CISCO IOS installed on CISCO routers
USP: Intrusion Detection functionality can be implemented using CISCO IOS Firewall eliminating the need for separate hardware or software.
Primary Link: http://bit.ly/1iBWCRz
Keywords: IDS, IOS