Configuring the SRX Series Device to Block Outbound Requests to a C&C Host
The C&C feed lists devices that attempt to contact a C&C host. If an outbound request to a C&C host is attempted, the request is blocked and logged or just logged, depending on the configuration. Currently, you configure C&C through CLI commands and not through the Web interface.
To create the C&C profile and policy and firewall policy:
- Configure the C&C profile. In this example the profile
name is cc_profile and threat levels 8 and above are blocked.
root@host# set services security-intelligence profile cc_profile category CC root@host# set services security-intelligence profile cc_profile rule CC_rule match threat-level [8 9 10] root@host# set services security-intelligence profile cc_profile rule CC_rule then action block drop root@host# set services security-intelligence profile cc_profile rule CC_rule then log root@host# set services security-intelligence profile cc_profile default-rule then action permit
- Verify your profile is correct using the show services
security-intelligence CLI command. Your output should look similar
to this.
root@host# show services security-intelligence profile cc_profile category CC; rule CC_rule { match { threat-level [ 8 9 10 ]; } then { action { block { drop; } } log; } } default-rule { then { action { permit; } log; } } - Configure your C&C policy to point to the profile
created in Step 1. In this example, the C&C policy name is cc_policy.
root@host# set services security-intelligence policy cc_policy CC cc_profile
- Verify your policy is correct using the show services
security-intelligence CLI command. Your output should look similar
to this.
root@host# show services security-intelligence policy cc_policy CC { cc_profile; } [edit] - Configure the firewall policy to include the C&C policy.
This example sets the trust-to-untrust zone.
root@host# set security policies from-zone trust to-zone untrust policy p2 match source-address any destination-address any application any root@host# set security policies from-zone trust to-zone untrust policy p2 then permit application-services security-intelligence-policy cc_policy
- Verify your command using the show security policies CLI command. It should look similar to this:
root@host# show security policies ...
from-zone trust to-zone untrust { policy p2 { match { source-address any; destination-address any; application any; } then { permit { application-services { security-intelligence-policy cc_policy; } } } } } ... [edit] - Commit your changes.