Log Intra Data Center Traffic That Matches the Intrazone
Allow Rule
Log east-west data center traffic between servers and
look for anomalous behaviors that may indicate the presence of an
attacker.
By default, all intrazone traffic (source
and destination in the same zone) is allowed. After the firewall evaluates
Security policy, it either allows traffic controlled by application
allow list rules, denies traffic controlled by block rules, or if
intrazone traffic matches no rules, the firewall allows it by default.
(The firewall blocks interzone traffic by default.) Because of the
valuable nature of data center assets, the best practice is to monitor
all traffic inside the data center between data center servers,
including traffic allowed by the intrazone default allow rule.
To
gain visibility into this traffic, enable logging on the intrazone-default
rule when it applies to traffic within zones inside the data center.
Logging this traffic gives you the opportunity to examine access
that you have not explicitly allowed and which you may want to either
explicitly allow by modifying an allow rule or explicitly block.
In Define
the Initial Intra-Data-Center Traffic Security Policy, we
used three example zones inside the data center: Web-Server-Tier-DC,
App-Server-Tier-DC, and DB-Server-Tier-DC. In this example, we create
a custom report to gather log information
about data center intrazone traffic in these three internal data
center zones.
- Select the intrazone-default row in the rulebase and clickOverrideto enable editing the rule.
- Select theintrazone-defaultrule name to edit the rule.
- On the Actions tab, selectLog at Session Endand clickOK.
- Create a custom report to monitor traffic that hits this rule for the internal data center zones.
- Select .
- Adda report and give it a descriptiveName. In this example, the name isLog Intrazone-Default Rule-DC.
- Set theDatabasetoTraffic Summary.
- FromAvailable Columns, addSource Zone,Destination Zone,Sessions,Bytes,Application,Risk of App,Rule, andThreatsto theSelected Columnslist. If there are other types of information you want to monitor, select those as well.
- Select theScheduledbox.
- Set the desiredTime Frame,Sort By, andGroup Byvalues. In this example, the selected values areThreatsandApp Category, respectively.
- Define the query to match traffic that matches the intrazone-default rule for the data center zones:(rule eq intrazone-default) and ((zone eq Web-Server-Tier-DC) or (zone eq App-Server-Tier-DC) or (zone eq DB-Server-Tier-DC))The query filters for traffic that matches the intrazone default rule and also matches any of the three internal data center zones that we defined. Because the defaultSelected Columnsinclude zones, the report shows the zone for each session. In a real-world data center, you would probably have more zones and you would add each zone to the query. The resulting custom report settings look like this:
- Committhe changes.
