Portscan is a form of network reconnaissance that is often used by attackers as a prelude to an attack. In a portscan, an attacker determines the types of network protocols or services a host supports and sends specially crafted packets to a targeted host. By examining the packets that the host responds with, the attacker can often determine which ports are open on the host and, either directly or by inference, which application protocols are running on these ports.
You can enable threat detection to watch for port scanning activity and optionally, automatically block scanners for a period of time.
Before you begin
FQDN, wildcard mask, any, any-ipv4, and any-ipv6 network objects are not supported for portscan configuration. These objects are not shown in the Monitor, Ignore Scanner, Ignore Target, and Exclude fields.
Procedure
Step 1 | In the access control policy editor, click Advanced Settings from the More drop-down arrow at the end of the packet flow line. Then, click Edit ( ) next to Threat Detection. |
Step 2 | In the Threat Detection window, select the Portscan mode:
-
Disable—Turn off threat detection. This is the default mode. You can click Revert to Defaults to return to this unconfigured state.
-
Detection—Perform portscan detection, but alert on problems only. Do not take action against potential attackers. We suggest you use this mode initially until you fine-tune the threat detection settings to avoid excessive false positives.
-
Prevention—Perform portscan detection and actively block identified scanners, that is, hosts that are performing the port scan.
|
Step 3 | Configure the Traffic Selection options.
The traffic selection options determine which networks are monitored, the type of connections monitored, and whether any scanners or target hosts should be exempted from the monitored networks. By default, the system monitors permitted connections on all networks.
-
Detection On Traffic—Select the types of connection that will be monitored for portscan activity: Permitted, Denied, or All traffic. The default is Permitted.
-
Monitor—Select the network objects that define the networks to monitor for portscan or sweep activity. The default is any network, IPv4 or IPv6. Use this option to limit scanning to untrusted networks.
-
Ignore Scanner—Select the network objects that define the hosts or networks, from within the range of the monitored networks, that should be ignored. For example, if you have set up your own scanner to test your network, you can exempt the address of your scanner to avoid unnecessary reporting on the address. Do not include addresses that are outside the monitored networks, as these addresses are already ignored.
-
Ignore Target—Select the network objects that define the hosts or networks that should be ignored as targets, that is, victims of a portscan or sweep.
|
Step 4 | Click the Configuration tab and select the scanning sensitivity level.
The pre-defined sensitivity levels, Low, Medium, and High, set the port scanning options to values that are increasingly aggressive. For example, if you select low, you would expect to see fewer port scanning events, and you could potentially miss attackers more easily than if you selected medium or high. On the other hand, if you select high, you might see more events and also potentially more false positives. The default level is medium. For more information on these levels, see Pre-defined sensitivity levels for portscan detection.
As you select the levels, you can see the related values within the protocol sections: TCP, UDP, IP, and ICMP. If you change any of the preset values, or disable a type of scan, the sensitivity mode automatically changes to Custom.
Within each protocol section, the options are:
-
Interval—The time range, in seconds, within which the configured values for portscan or portsweep are exceeded. For example, if you select 90 seconds, and 60 as the number of TCP portscan ports, a scanner would need to try 60 ports on a host within 90 seconds for it to be considered a portscan. The system generates events only if the number of ports, protocols, or hosts (for a portsweep) are exceeded within the specified interval.
You can specify a range between 30-600 seconds. The longer the period, the more likely a host might be identified as a scanner.
-
Portscan (TCP/UDP)—Select whether to monitor for port scanning against single hosts, and specify the number of ports that must be scanned within the interval to count as a portscan attack. The allowed range is 1-256.
-
Portsweep (TCP/UDP)—Select whether to monitor for port sweeping against multiple hosts, and specify the number of hosts that must be scanned for a given port within the interval to count as a portsweep attack. The allowed range is 1-256.
-
Protocol Scan (IP)—Select whether to monitor for protocol scanning against single hosts, and specify the number of protocols that must be scanned within the interval to count as a protocol scan attack. The allowed range is 1-255.
-
Protocol Sweep (IP)—Select whether to monitor for protocol sweeping against multiple hosts, and specify the number of hosts that must be scanned for a given protocol within the interval to count as a protocol sweep attack. The allowed range is 1-256.
-
Hostsweep (ICMP)—Select whether to monitor for ICMP host sweeping against multiple hosts, and specify the number of hosts that must be scanned within the interval to count as a hostsweep attack. The allowed range is 1-256.
|
Step 5 | If you selected prevention mode, click the Prevention tab and configure the options.
In prevention mode, hosts are automatically blocked from further scanning of networks on all protocols for the configured duration. Review the detection and prevention parameters carefully to ensure legitimate traffic is not blocked.
-
Exclude—Select the network objects that define the hosts or networks, from within the range of the monitored networks, that should be excluded from automatic blocking. Even if these hosts voilate your scanning detection parameters, the system will not block them.
-
Duration—How long, in seconds, automatically blocked scanner hosts should be prevented from sending traffic of any kind through the device. After the duration period ends, the hosts are automatically cleared and can again send traffic through the device. The allowed range is 600-2592000 seconds. The default is 3600 seconds (1 hour).
If you need to manually unblock a host, SSH to the firewall that is blocking the host and use the clear threat-detection portscan attacker command.
|
Step 6 | Click OK to save the threat detection settings. |
Step 7 | Click Save to save the access control policy. |
What to do next
Deploy configuration changes.