Network intrusion detection and prevention tools

Posted on 2014-11-13
Medium Priority
Last Modified: 2014-12-01
We are going thru an IRS audit and are being asked what network intrusion tools we use.  We currently have a hardware firwall Cisco ASA 5505.  Are there built in tools such as logging that we can use for network intrusion viewing?  Or is there another piece of hardware that we need.  I can poke around the firewall but I am not Cisco certified or CCNA by any means.
Question by:gebigler
LVL 18

Accepted Solution

Garry Glendown earned 1500 total points
ID: 40442026
ASA does not come with a real IDS/IPS as such. In order to get this feature on the 5505 (or any ASA, for that matter), you will need the IDS daughter card that installs into the ASA. Not sure about the prices, though, as we have stopped actively selling ASAs some time ago due to their software falling back behind the competition. Anyway, the IDS card will most likely work (we have one customer with a 5505 cluster and the IDS card, no problems to date, albeit the firewall is already configured rather restrictively, so dangers are already greatly minimized).

Depending on your throughput and feature demands, you could also look into devices from Fortinet. For very competitive prices (typically around 1/2 of what ASA devices with similar performance cost), you get a load of additional features without additional license cost. The base bundle already includes full IDS/IPS, content scan (AV/Malware) as well as webfiltering (with server categorization, etc.), SSL VPN (as well as IPSEC and PPTP), single sign on, web proxy, FW virtualization and much more ... also full HA capability without needing to pay for a license upgrade (as is the case for most smaller ASA models like 5505 or 5510). We've got multiple pairs deployed to protect our customers' webservers from attacks, which has reduced the number of successful attacks from something like 1 a day (don't ask ...) to less than one per quarter ...
LVL 66

Expert Comment

ID: 40442082
Strictly speaking ASA is FW and not prime as intrusion detection. ASA does port and ip filtering as a baseline unless it is talking about ASA module add on such as the AIP-SSM provides intrusion detection system (IDS)/intrusion protection system (IPS) features, the CSC-SSM operates as a content scanning and filtering module or even the CX that is the contextual visbility for the NG-FW. But assuming the minimal base for ASA, it is doing as the traditional stuff FW is supposed to do and of course we are saying it has to be hardened with the baseline from Enterprise. The industry baseline from Cisco itself is reference and supplemented by CIS and NIST is commonly reference. Below


Intrusion detection is really not the FW role but if you are looking at ASA mgmt aspect in such attempt the audit trail do are important aspect as already in the hardening practices. Maybe good to know the threat protection for ASA in ver 8 above
Using basic threat detection, the security appliance monitors the rate of dropped packets and security events caused by the following:

Denial by access lists.
Bad packet format, such as invalid-ip-header or invalid-tcp-hdr-length).
Connection limits exceeded, both system-wide resource limits and limits set in the configuration.
DoS attack detected, such as an invalid stateful packet inspection or stateful firewall check failure.
Basic firewall checks failed. This option is a combined rate that includes all firewall-related packet drops in this bulleted list. It does not include non-firewall-related drops such as interface overload, packets failed at application inspection, and scanning attack detected.
Suspicious ICMP packets detected.
Packets failed application inspection.
Interface overload.
Scanning attack detected. This option monitors scanning attacks; for example, the first TCP packet is not a SYN packet or the TCP connection failed the three-way handshake. Full scanning threat detection takes this scanning attack rate information and acts on it by classifying hosts as attackers and automatically shunning them, for example. Refer to Configuring Scanning Threat Detection for more information.
Incomplete session detection, such as TCP SYN attack detected or no-data UDP session attack detected.

Author Comment

ID: 40474689

Featured Post

Easily Design & Build Your Next Website

Squarespace’s all-in-one platform gives you everything you need to express yourself creatively online, whether it is with a domain, website, or online store. Get started with your free trial today, and when ready, take 10% off your first purchase with offer code 'EXPERTS'.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

This blog will spread awareness about Dropbox. We have given the statements based upon our experience. Along with this, there is a section of some new plans that should be added in Dropbox this year. This will make the storage service enhanced from …
You do not need to be a security expert to make the RIGHT security. You just need some 3D guidance, to help lay out an action plan to secure your business operations. It does not happen overnight. You just need to start now and do the first thin…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…
Is your data getting by on basic protection measures? In today’s climate of debilitating malware and ransomware—like WannaCry—that may not be enough. You need to establish more than basics, like a recovery plan that protects both data and endpoints.…

624 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question