Protocol enforcement

Protocol enforcement allows you to configure networking services (e.g. FTP, HTTP, HTTPS) on known ports (e.g. 21, 80, 443). For protocols that are not allowlisted under select ports, the IPS engine performs the violation action to block, allow, or monitor that traffic.

This feature can be used in the following scenarios:

• When one protocol dissector confirms the service of network traffic, protocol enforcement can check whether the confirmed service is allowlisted under the server port. If it is not allowlisted, the traffic is considered a violation and IPS can take the action specified in the configuration (block or monitor it).
• When there is no confirmed service for the network traffic, the traffic is considered a service violation if IPS dissectors rule out all of the services enforced under its server port.

In an applicable profile, a default-network-service list can be created to associate well known ports with accepted services.

In the following example, an application sensor is configured to enforce HTTP on port 80 (block), and DNS on port 53 (monitor).

To setup protocol enforcement in the GUI:

1. Go to Security Profiles > Application Control.

2. Create a new application sensor or edit an existing one.

3. Enable Network Protocol Enforcement.

   Enforcement entries can be created, edited, or deleted to configure network services on certain ports and determine the violation action.

   

4. In the Network Protocol Enforcement table click Create New.

5. Configure the entry for HTTP:

   1. Set Port to 80.

   2. Set Enforced protocols to HTTP.

   3. Set Violation action to Block.

   4. Click OK.

   

6. Configure the entry for DNS:

   1. In the Network Protocol Enforcement table click Create New.

   2. Set Port to 53.

   3. Set Enforced protocols to DNS.

   4. Set Violation action to Monitor.

   5. Click OK.

7. Click OK.

To setup protocol enforcement in the CLI:

config application list
    edit "protocol-GUI"
        set other-application-log enable
        set control-default-network-services enable
        config default-network-services
            edit 1
                set port 80
                set services http
                set violation-action block
            next
            edit 2
                set port 53
                set services dns
                set violation-action monitor
            next
        end
    next
end