700H Problem IPS "Security Service" and IPSEC

jef
jef Posts: 80  Ally Member
First Comment Second Anniversary
edited June 22 in USG FLEX H Series

IPsec-VPN tunnels, the tunnel traffic gets clobber by the IPS Security Service "Prevention" feature.

If I un "Enable" IPS, the vpn tunnels function fine.
Specifically running SSH connections over the VPN to or from remote servers.

If I "Enable" IPS the tunnels drop SSH traffic, then SSH starts throwing errors:
"kex_exchange_identification: read: Connection reset by peer".

So. How do I white list all IPSec tunnel traffic from the IPS.
I would like to leave "Prevention" on. But can not with IPS wrecking SSH.




All Replies

  • PeterUK
    PeterUK Posts: 3,838  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary
    edited June 22

    If you can find the Signature you can disable it but I'm not sure which one (don't have a License to test) under Query Signatures put in IKE you will find:

    Cisco Adaptive Security Appliance IKEv1 and IKEv2 Heap Buffer-Overflow

    try disabling that also check in logs might say which one

    or in IP Exception and put in the source by IP or FQDN

  • jef
    jef Posts: 80  Ally Member
    First Comment Second Anniversary

    "IP Exception and put in the source by IP or FQDN" that sounds hopeful.

    I don't know how the IPS works or the packet flow through the firewall.
    In my mind VPN is all LAN traffic and shouldn't be touched by the firewall, but again I do not understand the flow.
    And I do not understand the "signatures" and "rate bases signatures".

    This is my "IKE" query.

    IKE-Query.png

    My tunnels seem solid. They don't go down and don't seem to be re-establishing.
    What I do get, IPS shutdown down SSH traffic. If I am connected via ssh, is stays alive.
    But when you try to connected again, it may or may not depending on if IPS "rejects" the packets.
    "W Box: directory" is a successful ssh, to the W box, doing a "stat" on known directory.
    When it returns "directory" the ssh worked.
    But when IPS hits "kex_exchange…." And when the firewall kicks in, all LAN traffic fails.

    ShellDrop.png

    I'm going to try your "IP exception" idea.

  • jef
    jef Posts: 80  Ally Member
    First Comment Second Anniversary

    Hey.. I believe your "IP exception" idea is working. I'll have to keep an eye on it, but my test script isn't kicking errors and turned "Prevention" back on.

    I wasn't sure how to do the IP Exceptions. I put in one for each 'gate' and one for each 'vlan' both as source.

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）