 |
This section explains the step-by-step instructions for managing policy with Network Immunity Manager. You create a couple of policies, then manage them with NIM.
» Return to top
4.1 Create a policy: MAC lockout
First, create a policy for locking out MAC addresses. To create the policy:
- In PCM, go to the Policy Manager (use the
 icon) to launch the Policy Configuration Manager window.
- Select the Policies node in the navigation tree to display the Manage Policies panel, then click New to launch the Create Policy dialog. Create a new policy called Mac Lockout policy. (Or simply read through the different steps of policy creation if this policy already exists.) In the Properties tab enter the Name and Description; for example:
- Leave the Times tab as it is.
- In the Sources tab, leave the Selected Groups column set to No Groups selected. (In this case, the policy will accept events from any source.)
- In the Targets tab, enable the radio button for Target all alert sources (devices & ports) that trigger this policy:
- In the Alerts tab, select Default IP-Fanout, Default TCP/UDP-Fanout, and Default protocol anomaly, then click the right arrow (>>) to move them to the Selected Groups column on the right.
- In the Actions tab, create a new action called Mac Lockout, and in the Actions list choose Mac Lockout:
This configures actions the policy will take when it is executed.
- On the MACs tab, choose MACs in the event. This will enable NIM to block MAC addresses detected as offenders in the scans:
- Also create an action called Popup, and use the Create Action window to indicate that it will display a message dialog:
- On the Actions tab, choose Popup and Mac Lockout in the list of Available Actions and move them into the Selected Actions column. Click the Execute All radio button. Also, put a check in the box next to Rollback Actions, and set the time to 3 minutes. This will enable the policy to automatically unlock the blocked MAC address after 3 minutes:
- Finally, in the Manage Policies window, disable all default policies and enable the Mac Lockout policy:
» Return to top
4.2 Create another policy: port shutdown
Now create another policy.
- Create the policy Port shutdown, using the same procedure as for Mac Lockout. Specify the following parameters:
- Targets: Select Target all alert sources (devices & ports) that trigger this policy.
- Alerts: Select Default TCP/UDP-Fanout, Default IP-Fanout, and Default protocol anomaly.
- Actions: Create a new action, Port shutdown.
- From the list of pre-configured actions, select Port shutdown; and in the Port Status tab of this action choose
Disabled.
- Enable this policy and disable the Mac Lockout policy.
» Return to top
4.3 View a security heatmap
The Network Maps window in PCM also provides an overview of the security state of the managed network based on
data from NI Manager. It can display the security totals by category and severity.
To view a security heatmap:
- In PCM, click on the Network Map node in the navigation tree to display the network map.
- In the Device View pulldown menu choose Ping Status (the default) to see the devices that are operational:
- In the Link View area, enable Duplex Info. You see that the link between the devices is in FDX on both sides.
- Also, enable Link Speed to show the speed of the link between the 5400 switch and the 3500 switch:
- Finally, enable Port Name to show which ports are interconnected:
- Now change the Link View from Link Status to VLAN. The network map displays the different VLANs that are tagged on the link between the two switches:
- Change the Link View to Traffic. You can see the traffic between the two devices appears in green, which
means the link is not busy:
- Now change the Device View to Security State. You see the ProCurve Switch 3500 now appears pink,
indicating that security events were detected on it.
You can display the number of events per switch by category (Security Totals by Category). The two categories are ProCurve, for the events detected by the switches or NIM; and External for events coming from a third-party IDS/IPS or UTM. You can also display events according to severity (Security Totals by Severity).
- Click on one of the switches in the Network Map. You get to the Interconnect Devices level, where you can
see the Security Activity tab with a list of actions executed by the Policy Manager on each switch.
At this level, you have the choice of three tabs, depending on how you want to see security events organized:
- Alerts: ProCurve or External
- Actions: By type of action performed by the policy manager in response to the attacks
- Offenders: By IP address of the attacker
Choose the Actions tab to see the actions (e.g., Mac Lockout, Disable Port) performed in response to attacks:
- To see this Security Activity as a bar chart, change the View to Bar Chart (Action Type). You see a chart with
a different color for each type of action:
» Return to top
4.4 Track offenders
Another feature of Network Immunity Manager is offender tracking. To see offender tracking:
- Go to the switch or Interconnect Devices level, and select the Security Activity tab.
- Click on the Offenders tab, and ensure all Filters are enabled. By default, you see a table with the list of
Offenders, and for each one, the number of events received in each severity category (Normal, Warning,
Minor, Major, Critical):
- To see the offenders and their statistics as a bar chart, change the View to Bar Chart (Severity):
- To see the proportion of attacks per offender (listed by IP address), change the View to Totals (Offender):
- Double-click on an offender’s section of the chart and you can obtain a history of security events and policies associated with this offender’s IP address.
- Click on one of the lines of the Policy History to obtain the details of the event and policy.
In the Properties section you can view the following information:
- Name, type, description of the alert
- Offender’s IP, MAC address, connected device, and port
- Result of the alert: enforcement of a policy
The Configuration section shows the threshold (number of events over a given period) that were necessary to
generate the security alert.
Then, if an action was applied by this policy, you can see an Action Properties section, including:
- Name and type of the action
- Start and end date of creation, last edition, and who created it
- Start and end date of enforcement
You also can view the Action Configuration and Action Progress, showing the level of success of
enforcement:
» Return to top
|
