advanced functionality & troubleshooting. page 2 agenda internet shield architecture advanced...

ADVANCED FUNCTIONALITY &TROUBLESHOOTING

Agenda

Internet Shield Architecture

Advanced functionality

• IDS vs. packet filter

• Stateful packet filters

• Dynamic firewall rules

• Cisco Network Admission Control (NAC)

Troubleshooting

• Troubleshooting Internet Shield configurations

• Inspecting logfiles

PROCESSES AND SERVICES

AVCS Processes

F-Secure Management Agent

• fameh32.exe, fch32.exe, fsih32.exe, fsnrb32.exe, fsm32.exe, fsma32.exe, fsmb32.exe, fsguidll.exe

F-Secure Virus & Spy Protection

• fsav32.exe, fsaw.exe, fsgk32.exe, fsgk32st.exe, fsdfwd.exe, fsqh.exe, fsrw.exe, fssm32.exe

F-Secure Automatic Update Agent

• fsbwsys.exe, F-Secure Automatic Update.exe

Processes: FSMA

fsm32.exe F-Secure Manager, displays the F- tray icon

fsma32.exe F-Secure Management Agent (Service)

fsmb32.exe Message Broker, processes communication between the different modules of the various products

fsnrb32.exe Handles the communication between the hosts and the PMS

fameh32.exe Alert and Messaging Handler, handles alert and log forwarding

fch32.exe Configuration Handler, reads the base policy files and writes the incremental policy files

fsih32.exe Installation Handler. Launches ilaunchr.exe during installations

Processes: Virus & Spy Protection

fsav32.exe Anti-Virus Handler

fsaw.exe F-Secure Ad-Watch (Browser Control)

fsdfwd.exe Anti-Virus Firewall Daemon. Redirects e-mails to

the Scanner Manager (Service)

fsqh.exe Handles object quarantine

fsgk32.exe Gatekeeper Handler. Receives real-time scan

requests from the Gatekeeper

fsgk32st.exe Gatekeeper Handler Starter (Service)

fsrw.exe F-Secure Reg-Watch (System Control)

fssm32.exe Scanner Manager. Manages scanning engines

Virus & Spy Protection Services

F-Secure Management Agent Environment

• NET STOP/START FSMA: fameh32.exe, fsaw.exe, fch32.exe, fsih32.exe, fnrb32.exe, fsm32.exe, fsma32.exe, fsmb32.exe, fsdfwd.exe, fsrw.exe, fsguidll.exe

F-Secure Gatekeeper Environment

• NET STOP/START FSGKHS: fsgk32.exe, fsgk32st.exe, fssm32.exe

F-Secure Automatic Update Environment

• NET STOP/START FSBWSYS: fsbwsys.exe, F-Secure Automatic Update.exe

INTERNET SHIELD ARCHITECTURE

Product Components

ServicesServices

KernelKernel

Firewall Engine

Firewall Daemon

Management Agent (FSMA)

Email Scanning Module

DesktopDesktop

User Interfaces

F-Secure Manager

FirewallPlug-ins

Dial-up ControlAPI Hook

Packet Filter IDS

Interceptor

Firewall Engine

Fsdfw.sys

• Kernel mode component

• Firewall engine does the actual filteringbased on rules

• Intrusion detection, packet filtering andapplication control are all done in Firewall Engine

• IDS handles the packets before packet filter

• TDI Driver is taking care of connection request filtering / checking which is needed for application control

• TCP "listen", TCP "connect", UDP "listen", UDP "sendto", RAWIP "create“

Interceptor

Fsndis5.sys

• Kernel mode component

• Loaded by Firewall Engine (fsdfw.sys)

• Intercepting network traffic in the NDIS layer

• Main purpose is to hook the network traffic and forward it to firewall engine

Fsdc.dll

• DC hooking DLL is injected into the dialer process.

• RAS API calls are redirected to the DC hooking DLL

• Allow or deny decision comes through policy (whitelist) or through user decision (prompt)

Dial-up ControlAPI Hooking

Firewall Daemon

Fsdfwd.exe

• User mode component

• Receives alerts and status information directly from firewall engine

• Reads everything from policy tables

• Reads connection information received from TDI Driver

• Receives dial requests from the DC DLL and makes the decision to allow or deny the operation

• Sends firewall rules (filter) and IDS database to firewall engine

• Writes ACTION.LOG and DIAL.LOG

Firewall Plug-in

Fsdfwpi.dll

• User lnterface component

• IS Plug-in for F-Secure Manager (fsm32.exe)

• Displays dialogs to the end user (note: static firewall settings are handled by the AV main & advanced GUI)

ADVANCED FUNCTIONALITYIDS VS. PACKET FILTER

Packet Filter Limitations

Intrusion Detection Systems are becoming more and more popular

• Packet filters aren’t enough to secure the corporate networks

• While a firewall closes all unused ports, it cannot protect you from intentionally left open ports

• Closing all ports would affect the corporation’s operational requirements

Example: A corporation leaves open TCP 80, so that HTTP traffic can

reach the web server

• How can the firewall then protect the network against the countless HTTP based exploits

• This is where IDS comes in…

The Anti-Virus for your Network…

Basically, IDS does for your network what Anti-Virus does for your file system

IDS Solutions

• Signature based engines

• Pre-defined patterns tell the system, what type of network traffic most commonly correspond to an attack

• Heuristic engines

• The IDS learns over time, what patterns are considered normal for your network

• Pro: Doesn’t rely on signatures, able to detect unknown patterns

• Contra: Increasing number of false positives

Intrusion Detection System (IDS)

IDS engine is divided in 3 parts

• Generic IP engine

• UDP protocol engine

• TCP protocol engine

The system currently alerts on 31 malicous packets (13 IP, 5 UDP,

13 TCP)

• Database selected carefully to avoid false positives

Firewall Engine

Was that Really a Network Worm?

Worm traffic

Normal trafficHeader

Payload=> TCP <Port>

None

IDS

Packet Filter

Header

Payload=> TCP <Port>

Worm

1

2

STATEFUL PACKET FILTERS

Stateful Packet Filter

The firewall keeps a log of all open connections and the current state

of all active connections

Maintains a database of allowed and active IP based connections

• Uses the connection database to check if the datagram is part of an accepted connection

Works for all IP Protocols (most common TCP, UDP and ICMP)

Echo Outbound (Ping):Static Filter

Following packet filter rules are needed

• Outbound: allow echo (Protocol: ICMP, Type: 8)

• Inbound: allow echo reply (Protocol: ICMP, Type: 0)

Host BResponder

Host AInitiator

Echo Echo

Echo Reply Echo Reply

Host BResponder

Host AInitiator

Echo Echo

Echo Outbound (Ping):Stateful Filter

Following packet filter rules are needed

• Outbound: allow echo (Protocol: ICMP, Type: 8)

Echo Reply Echo Reply

ListenICMP, 0

APPLICATION CONTROLDYNAMIC FIREWALL RULES

The Internet Shield stateful packet filter works with two kinds of rules

types

Static rules

• Included in the pre-defined security levels or created by administrators

• Applied to domains or host via security levels (on PMC), always valid!

Dynamic rules

• Created on the host at application launch (not related to security levels)

• Valid as long as the process is running

• Created only for server network applications opening a listening connection

Static Rules vs. Dynamic Rules

Dynamic Firewall RulesWhere to check them...?

Dynamic firewall rules can only be viewed in the Policy Manager

Console

• There is no reporting of such rules back to the Policy Manager Server

• The rules can be viewed from the local advanced user interface or in specific logfiles (fulldiag.htm)

Static Rules

Dynamic Rules

Firewall Dynamic RulesPlacement

Dynamic firewall rules are placed between the second last packet

filter rule and the deny all rule

• The catch rule is not blocking inbound traffic, which matches one of many dynamic listening rules!

• Block unwanted inbound traffic with specific static rules!

Firewall Dynamic RulesOperation

Host A Host B

POP3 Server

X

Host C

Listen TCP 110 <= 0.0.0.0/0

1

2

3

4

CISCO NETWORKADMISSION CONTROL

NAC is built from components of Cisco and various third party vendors (e.g. F-Secure)

Cisco components

• Cisco Trust Agent (CTA)

• Cisco IOS Network Access Device (NAD)

• Access Control Server (ACS)

F-Secure components

• Policy Manager Console

• Cisco NAC support plug-in

CTAFS Plug-in ACS

NAD

System Components

Cisco Trust Agent (CTA)

One of the core components of the

NAC system

• Must be installed on each client, whose policy state is to be validated before permitting network access

• Can be rolled out with PMC

• Checks Anti-Virus Client Security for the following posture validation attributes

F-Secure Plug-in for Cisco NAC

Used by the Cisco Trust Agent, when

checking the posture validation attributes

of Anti-Virus Client Security

• Posture validation attributes are

• Virus definitions update status

• Real-time scanning protection status

• Firewall protection status

• Installed at the same time as CTA is installed

• Intelligent or policy based installation with PMC

Cisco Network Access Device (NAD)

The NAD permits or denies network access

• Begins the client posture validation

• Typically a Cisco router

Cisco Access Control Server (ACS)

ACS is responsible for obtaining and evaluating the posture validation

attributes

• Determines the overall system posture

• Provides the appropriate network access policy to the NAD, based on the system posture

ACS configuration example

• Healthy: Full network access granted

• Checkup: Outdated virus definitions => usually no access restrictions

• Quarantine: Outdated virus definitions during outbreak => access restrictions

• Unknown: No Cisco Trust Agent installed => access restrictions

TROUBLESHOOTING

Typical Connection Problems

Application Level (Application connection control)

• Application was by mistake denied from establishing connections

• Acting as client (e.g. Internet Explorer)

• Acting as server (e.g. nslookup)

Firewall Level (NDIS Layer)

• Firewall blocks or allows all or certain connections

• Second Firewall is installed (e.g XP firewall, overblocking traffic)

• Firewall allows certain traffic, even though you have no specific allow rules

• Remember the Application Control dynamic rules

• Create specific static deny rules (or use pre-defined security levels)

Analyzing Internet Shield Problems

Recommended ways to analyze Internet Shield problems are

1. Locally: Using the AVCS user interface

2. Remotely: Using Internet Shield web interface or console

12

Local TroubleshootingFirewall Rules

Static rules (outbound and inbound)

• Any rules blocking traffic?

• Any rules allowing unnecessary inbound traffic?

Dynamic rules

• Any applications running, which allow unwanted inbound traffic?

Local TroubleshootingFirewall Settings

Trusted Interface

• Make sure that this setting is locked (PMC => Advanced interface)

• If adapters are trusted, all traffic passes unfiltered!

Suspicious traffic alerting

• Don’t enable alerting of illegal packets (will create unnecessary alerts, increasing the size of your commdir)

• Can be used for debugging purposes on specific hosts

Local TroubleshootingApplication Control Rules

Application Connection Control list

• Listing all connection rules

• Separate row for server and client applications

• To avoid wrong user decisions, configure Application Control as follows

• First create a detailed application list (using test computers)

• After that, deny all new, unknown connections (client and server applications!)

Two main log files

• Action log; All firewall actions

• Packet log; All packets (header + payload)

Local TroubleshootingMain Logfiles

Remote TroubleshootingInternet Shield Web Interface

HTTP interface, providing you with the following information

• Firewall Rules

• Active security level

• FW rules (grey: enabled, white: disabled)

• Services

• Pre-defined and custom services

• Firewall alerts

• Including detailed information

All information seen in the web interface is in real-time!

• Compared to the console, where you always have a certain delay

Example: Remote Troubleshooting

Remote administration often works best when combining different tools

• Problem: Security Level on host doesn’t change (eventhough setting is final and forced down)

• Using remote web interface tells you the current active level

• Solution: Currently selected security level is not enabled, therefore even forcing setting change doesn’t work

• Enable it and distribute the policies

Testing Firewall Configurations

Problem: You don’t know if the security level holds up against different

kind of network attacks

• Select a host which currently has the security level in question active

• Run a full portscan (e.g. using nmap portscan tool)

• Only target that specific host

• Never run portscans in production networks! (unless you are responsible for the network)

Example: RPC Port Scan

Portscan Tool: nmap (available at www.insecure.org)

Type of scan: RPC scan (Remote Procedure Call related ports)

Security Level: Custom (no static rules, active dynamic rules!)

F-Secure Diagnostics Tool FSDIAG.EXE

Diagnostics tool included in the

installation package

• Collects important system information (eg. logfiles) to an archive on the local disk

Access points

• C:\Program Files\F-Secure\Common\ fsdiag.exe

• Fsdiag.tar.gz in the same directory

Analyzing FSDIAG

System information

• osver.log

• hardware.log

• netstart.log

• system.evt

Network information

• ipconfig.log

• route.log

Conflicting Software

• appliation.evt

• reg_run.log

AVCS internal alerts

• logfile.log

Firewall overview

• fulldiag.htm

Virus definitions update information

• header.ini

• daas.log

Summary

Internet Shield Architecture

Advanced functionality

• IDS vs. packet filter

• Stateful packet filters

• Dynamic firewall rules

• Cisco Network Admission Control (NAC)

Troubleshooting

• Troubleshooting Internet Shield configurations

• Inspecting logfiles

advanced functionality & troubleshooting. page 2 agenda internet shield architecture advanced...

Documents

engine slide

fsecure virus spy protection

services slide

logfiles slide

installations slide

firewall engine ids

f tray icon

antivirus firewall daemon