A System Administrator sees a lot of Ping_Sweep events reported as blocked on the network. However, because the Ping_Sweep signature only blocks the ping packet that triggers the event, most of the ping packets are allowed through the XGS.
How can these suspicious packets be effectively blocked from the network?
A
Add a quarantine response to the Ping_Sweep event.
B
Add a Network Access policy rule to reject ICMP traffic.
C
Add a catch-all rule to the bottom of the NAP that rejects all traffic.
D
Enable the Ping_Sweep event in the default IPS policy with the Block option.
Correct Answer:
A
Question -
Why are some events allowed after setting a block response?
Cause -
Most network attacks are carried out in a single packet or in several packets that are reconstructed into a single "session." For these attacks, the Block response in the XGS Intrusion Prevention policy is appropriate to use, and is translated into a block packet response and/or into a block connection response.
Certain events, however, are classified as "non-sequitur." Non-sequitur events are events that require a succession of packets to occur before the signature is triggered. For example, a port scan signature may require a succession of ten port probes before the signature would trigger. In this case, many of the offending
"packets" would have already passed through the system.
Answer -
For these types of signatures, you must set the Quarantine response in addition to the Block response under the Default Repository > Shared Objects > Intrusion
Prevention > select signature > Edit > enable the quarantine response under the Quarantine tab > Save. The quarantine response blocks the offending IP for a period of time, ensuring that the remaining probes do not get through. The standard block packet or drop connection responses (set by the Block response) are ineffective in stopping this kind of activity when not used in conjunction with Quarantine.
List of non-sequitur events include SSH_Brute_Force.
References:
http://www-01.ibm.com/support/docview.wss?uid=swg21687475
Show Answer
