Protocol enforcement

Protocol enforcement allows you to configure networking services (e.g. FTP, HTTP, HTTPS) on known ports (e.g. 21, 80, 443). For protocols that are not allowlisted under select ports, the IPS engine performs the violation action to block, allow, or monitor that traffic.

This feature can be used in the following scenarios:

• When one protocol dissector confirms the service of network traffic, protocol enforcement can check whether the confirmed service is allowlisted under the server port. If it is not allowlisted, the traffic is considered a violation and IPS can take the action specified in the configuration (block or monitor it).
• When there is no confirmed service for the network traffic, the traffic is considered a service violation if IPS dissectors rule out all of the services enforced under its server port.

In an applicable profile, a default network service list can be created to associate well known ports with accepted services.

In the following example, an application sensor is configured to enforce HTTP on port 80 (block), and DNS on port 53 (monitor).

To configure protocol enforcement in the GUI:

1. Go to Security Profiles > Application Control.
2. Create a new application sensor or edit an existing one.
3. Enable Network Protocol Enforcement.

   Enforcement entries can be created, edited, or deleted to configure network services on certain ports and determine the violation action.

4. In the Network Protocol Enforcement table, click Create New.
5. Configure the entry for HTTP:
   1. For Port, enter 80.
   2. For Enforced protocols, select HTTP.
   3. For Violation action, select Block.
   4. Click OK.

      

6. Configure the entry for DNS:
   1. Click Create New, then for Port, enter 53.
   2. For Enforced protocols, select DNS.
   3. For Violation action, select Monitor.
   4. Click OK.

      The entries are displayed in the table.

      

7. Click OK.

To configure protocol enforcement in the CLI:

config application list
    edit "protocol-GUI"
        set other-application-log enable
        set control-default-network-services enable
        config default-network-services
            edit 1
                set port 80
                set services http
                set violation-action block
            next
            edit 2
                set port 53
                set services dns
                set violation-action monitor
            next
        end
    next
end