{"id":936,"date":"2022-04-30T12:20:43","date_gmt":"2022-04-30T11:20:43","guid":{"rendered":"https:\/\/www.labtinker.net\/?p=936"},"modified":"2022-04-30T12:20:43","modified_gmt":"2022-04-30T11:20:43","slug":"cisco-firepower-and-non-std-ssh","status":"publish","type":"post","link":"http:\/\/18.135.13.153\/?p=936","title":{"rendered":"Cisco Firepower and non-std SSH"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">At my new place of work I have encountered Cisco&#8217;s NGFW offering: Firepower. The firewall policies are administered on an FMC (Firewall Management Center) and pushed or deployed to enforcement modules called FTDs (Firepower Threat Defense) . Instead of FTD&#8217;s you can do this on  ASAs with an SFR module but I digress . Posts passim will testify that I like to test NGFWs by seeing how easy it is to get them to block SSH running on a non-standard ports.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The setup is the same as I have used elsewhere so I won&#8217;t go into great detail: I have a linux host running ssh on port 80 on <strong>linux.labtinker.net <\/strong>and I have a host on a DMZ which routes to the Internet through an FTD  which will try and access said Linux server on said port using said protocol.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">And I&#8217;ve got to say It was pretty straight foward. I had the following Access Policy defined on the FMC:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-1024x83.png\" alt=\"\" class=\"wp-image-937\" width=\"1141\" height=\"92\" srcset=\"http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-1024x83.png 1024w, http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-300x24.png 300w, http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-768x62.png 768w, http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-1536x124.png 1536w, http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image.png 1563w\" sizes=\"auto, (max-width: 1141px) 100vw, 1141px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">&#8230;with these rules&#8230;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-1-1024x110.png\" alt=\"\" class=\"wp-image-938\" width=\"1118\" height=\"120\" srcset=\"http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-1-1024x110.png 1024w, http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-1-300x32.png 300w, http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-1-768x82.png 768w, http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-1-1536x164.png 1536w, http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-1.png 1915w\" sizes=\"auto, (max-width: 1118px) 100vw, 1118px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The FMC\/FTD has the concept of a &#8216;Trust&#8217; action which means the traffic isn&#8217;t inspected and the first rule is trusting DNS and NTP (please note &#8211; this is not intended as best practice guide &#8211; you may not want to trust anything &#8211; this is just a guy messing around in a lab) but the next rule is where the action is happening.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">So drilling down into the relevant parts of the other rule&#8230;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"276\" src=\"http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-2-1024x276.png\" alt=\"\" class=\"wp-image-939\" srcset=\"http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-2-1024x276.png 1024w, http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-2-300x81.png 300w, http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-2-768x207.png 768w, http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-2.png 1250w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption>Zones<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"140\" src=\"http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-3-1024x140.png\" alt=\"\" class=\"wp-image-940\" srcset=\"http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-3-1024x140.png 1024w, http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-3-300x41.png 300w, http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-3-768x105.png 768w, http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-3.png 1281w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption>Networks<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">&#8230;and where the magic happens&#8230;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"204\" src=\"http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-4-1024x204.png\" alt=\"\" class=\"wp-image-941\" srcset=\"http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-4-1024x204.png 1024w, http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-4-300x60.png 300w, http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-4-768x153.png 768w, http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-4.png 1278w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption>Applicatons<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-5-1024x148.png\" alt=\"\" class=\"wp-image-942\" width=\"840\" height=\"121\" srcset=\"http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-5-1024x148.png 1024w, http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-5-300x43.png 300w, http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-5-768x111.png 768w, http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-5.png 1282w\" sizes=\"auto, (max-width: 840px) 100vw, 840px\" \/><figcaption>Ports<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">I have kept things simple in this rule by not using any other available features such as decyrption or an IPS policy. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">So from my DMZ host trying to login to the ssh server through the FTD I&#8217;m not getting any joy&#8230;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"685\" height=\"128\" src=\"http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-6.png\" alt=\"\" class=\"wp-image-943\" srcset=\"http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-6.png 685w, http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-6-300x56.png 300w\" sizes=\"auto, (max-width: 685px) 100vw, 685px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">&#8230; and checking in the FMC&#8217;s logs&#8230;(Analysis\/Connection Events):<\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-8-1024x88.png\" alt=\"\" class=\"wp-image-945\" width=\"1147\" height=\"98\" srcset=\"http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-8-1024x88.png 1024w, http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-8-300x26.png 300w, http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-8-768x66.png 768w, http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-8-1536x133.png 1536w, http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-8.png 1750w\" sizes=\"auto, (max-width: 1147px) 100vw, 1147px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">so full marks. Out of interest I went back to the above rule and changed the application part as follows:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"151\" src=\"http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-9-1024x151.png\" alt=\"\" class=\"wp-image-946\" srcset=\"http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-9-1024x151.png 1024w, http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-9-300x44.png 300w, http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-9-768x113.png 768w, http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-9.png 1300w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">and then re-tested and I was able to login straight away<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"567\" height=\"205\" src=\"http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-10.png\" alt=\"\" class=\"wp-image-947\" srcset=\"http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-10.png 567w, http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-10-300x108.png 300w\" sizes=\"auto, (max-width: 567px) 100vw, 567px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">And we can see this connection allowed in the logs together with the previously blocked traffic:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-11-1024x81.png\" alt=\"\" class=\"wp-image-948\" width=\"1049\" height=\"82\" srcset=\"http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-11-1024x81.png 1024w, http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-11-300x24.png 300w, http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-11-768x60.png 768w, http:\/\/18.135.13.153\/wp-content\/uploads\/2022\/04\/image-11.png 1537w\" sizes=\"auto, (max-width: 1049px) 100vw, 1049px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The protocol is no longer recognised &#8211; presumably because we are no longer doing application inspection.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">On first blush, I&#8217;ve found a few things about Firepower a bit clunky compared to other NGFWs but in terms of ease use defining rules to allow\/disallow applications I&#8217;d think it&#8217;s second only to the Palo&#8217;s which gives us a current league table (assembled from previous labs) of:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">1\/ Palo Alto 2\/ Cisco Firepower 3\/ Fortigate 4\/ Checkpoint 5\/ Cisco ASA <\/p>\n","protected":false},"excerpt":{"rendered":"<p>At my new place of work I have encountered Cisco&#8217;s NGFW offering: Firepower. The firewall policies are administered on an FMC (Firewall Management Center) and pushed or deployed to enforcement modules called FTDs (Firepower Threat Defense) . Instead of FTD&#8217;s you can do this on ASAs with an SFR module but I digress . Posts [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[],"class_list":["post-936","post","type-post","status-publish","format-standard","hentry","category-firewalls"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"http:\/\/18.135.13.153\/index.php?rest_route=\/wp\/v2\/posts\/936","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/18.135.13.153\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/18.135.13.153\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/18.135.13.153\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/18.135.13.153\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=936"}],"version-history":[{"count":0,"href":"http:\/\/18.135.13.153\/index.php?rest_route=\/wp\/v2\/posts\/936\/revisions"}],"wp:attachment":[{"href":"http:\/\/18.135.13.153\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=936"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/18.135.13.153\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=936"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/18.135.13.153\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=936"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}