Monitoring firewall logs, what to do about what you find?

[packdragon]

I am taking over the duties of monitoring the log files our firewall spits out. Unfortunately the guy before me didn't tell me exactly what I need to do. I'm staring at these logs, but what do I do about what I find?

Ok here's an example. This morning I'm working and all of a sudden I get like 5 log files emailed at once. The vast majority say "IP spoof detected", and come from the same 3 IP addresses. Looks like an attack to me. Pings to the IP addresses time out. What do I do about it?? What's the best next step?

 

[sleipnir214]

That largely depends on how your firewall reacted to the threat when it logged it.

If the firewall blocked the spoof and logged it, you're okay. If the firewall's ruleset set it through and logged it, you have bigger problems. Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!

 

[packdragon]

I doubt our previous sysadmin, who was very good at his job, would have configured the ruleset to allow in IP Spoofs. What would be the purpose of that?

But anyway, what are the things I should be looking out for? Logs that indicate someone was let in? I see a few entries that say "Accepting IPSec Proposal". What does that mean?

 

[sleipnir214]

packdragon:

No offense to you or your predecessor, but "I doubt...would have configured" definately fall under the category "Famous Last Words". You now administer a firewall: by definition, a certain amount of paranoia is in order. Do not assume the state of your firewall ruleset -- confirm the state of your firewall ruleset.

I honestly can't tell you what to look for, except in the most extremely general sense. I don't know the topology and use of your network, nor how your firewall rules support that topology and use. So my answer can only be: Do you see anything in the logs that might indicate a use of the network in a way that is counter to the way you know it should be used?

The "Accepting IPSec Proposal" sounds to me like the initialization of a road-warrior VPN connection. Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!

 

[Robnhood]

I would be looking for trends and who is doing the attacking. It is a little easier if you have something that does that like ACID with snort. There are also products to help you manage the firewall logs. NETIQ firewall suite for example. AKA Intrusion Detection System.

Craig

http://www.SecurelySpeaking.com