Protocol enforcement

Protocol enforcement allows you to configure networking services (e.g. FTP, HTTP, HTTPS) on known ports (e.g. 21, 80, 443). For protocols that are not allowlisted under select ports, the IPS engine performs the violation action to block, allow, or monitor that traffic.

This feature can be used in the following scenarios:

• When one protocol dissector confirms the service of network traffic, protocol enforcement can check whether the confirmed service is allowlisted under the server port. If it is not allowlisted, the traffic is considered a violation and IPS can take the action specified in the configuration (block or monitor it).
• When there is no confirmed service for the network traffic, the traffic is considered a service violation if IPS dissectors rule out all of the services enforced under its server port.

In an applicable profile, a default-network-service list can be created to associate well known ports with accepted services.

To setup protocol enforcement in the CLI:

config application list
   edit "protocol-GUI"
      set other-application-log enable
      set control-default-network-services {enable | disable}   # Enable/Disable enforcement of protocols over select ports
      config default-network-services                           # Default network service entries
         edit 1
           set port 80                        # Port number, enter an integer value from <0> to <65535>
           set services http                  # Network protocols: http, ssh, ftp, dns, smtp, pop3, imap, snmp, nntp, and https
         next
         edit 2
           set port 53
           set services dns
           set violation-action {pass | monitor | block}      # Pass, Log, or block when non-DNS traffic run over port 53
         next
      end
   next
end

To setup protocol enforcement in the GUI:

1. Go to Security Profiles > Application Control.
2. Create a new application sensor or edit an existing one.
3. Enable Network Protocol Enforcement.

   Enforcement entries can be created, edited, or deleted to configure network services on certain ports and determine the violation action.

   

4. Click Create New in the Network Protocol Enforcement table.

   

5. In the New Default Network Service pane:
   1. Enter a Port number.
   2. Select Enforced protocols.
   3. Choose the Violation action.
   4. Click OK.
6. Click OK.