[Autogenerated] Let's get started by talking about how to
integrate snore with the open source firewall,
PF sense.
This integration is done via the PF sense package
manager and it's super easy to install,
I'll show you how it works in the next clip when
integrating Snort with PF sense, there's a few features that stand out 1st.
You have a gui to manage everything in the rules,
the interface configurations and the alerting behavior can all be
controlled via a GUI You can use the alerts that snort generates to
explore more information like looking up the I.
P.
S or fully qualified domain names,
you can easily swap which rules that you want and turn on and off or
modified rules with a few clicks and managing the IP list is super
easy with this installation of Snort, you can also support in line I PS mode,
this means that you can actively block the bad actors and
help automate some of the isolation.
Alright, let's hop into the lab and check it out.
Alright and here we are in our lab for this first demo of the course.
And what we're gonna do is we're gonna talk about how snore integrates
with PF sense and the free firewall that we've been talking about that
Snort easily integrates with this integration gives you some really nice
GUI capabilities and we'll expand on some GUI integrations with Snore
later on in the course as well.
When we talk about Cisco firepower and a couple other technologies but this is
cool because it's nice and open source so you can put it in your lab without
any licensing and you can easily go in install,
store and get it up and running.
So what we're gonna do is we're gonna install snort real quick and
then kind of show you around the different configuration items and how
it actually integrates with the firewall.
So the first thing I'm gonna do is go to the package manager.
This is where we download the additional modules in Pf sense and
if you've never touched this firewall before,
you need a refresher on it or you need to understand how to
build it in your particular environment or lab.
Pluralsight has a couple of courses available to help you with this.
So you can go check them out.
But the package manager here is what allows us to install additional
capabilities and we have different packages available.
We have ones for net flow, we have ones for I.
P.
S capabilities.
We have bind.
Uh so there's a lot of different capabilities that we have in here.
If we scroll down to the S.
Section or you can just search for it.
We should see snort.
There we go.
Alright.
And so all we have to do is click install and confirm it and
we'll let pf sense do its thing install the package and this
will take a couple of minutes.
I spent the video up a little bit, but now it's installed, ready to go.
So where do we go from here.
Well when we're setting up snort with the pf sense firewall,
we need to start configuring it now to do so we need to go
over to the services menu and as you can see,
we have this new snort option here.
So let's click that.
And now we have our snort configuration menus here.
There's only one interface shown here, but that's okay.
We'll come back to these in a second.
The first thing we're going to do is go over to the global settings.
Now this is where we can add our rule sets so we can use
the snort subscriber rule sets by Talos.
We can sign up for the free registered user rules.
So we have a lot of the same capabilities that we have with the native
snort instance in Linux or any other operating system.
We can also enable the download of the community rule sets here,
emerging threats and so on and so forth.
Here's also where we would configure our rule update
settings and just the general settings for blocking hosts
and how the behavior around that is.
So the next tab I want to go to is the updates and when we
installed snore it updated the rule set automatically for us
that came standard with the configuration.
So we should be good on here unless we want to download the
subscriber rule sets or any of the other ones.
We also have the alerts tab,
which is where we would see all of the alerts if we had an interface
enabled to actually process the snort traffic.
Same with the blocked tab.
This is where we would go view those hosts that were blocked by snort.
We can suppress different rules here as well.
We can create our IP lists, manage the rule states as well.
And then of course we have our log settings and our sync
settings and everything like that.
Now on an interface, if we wanted to enable snore,
we could either add another interface that we have.
For example,
here we have our management interface and this is where we would set
up the settings for how we send alerts for it,
how we block offenders or if we will block offenders or are we going to
just use this as an ideas and then also we can configure some detection
settings define our home net in our external net,
which is typical in snort installations and customize Either options
for passthroughs or alert suppression and filtering.
And now if you wanted to enable this interface,
just as is we can hit save,
let's enable the log settings real quick and packet capture now that it's saved.
We can go over to the categories too.
So this is where we would select which categories of rule sets or of rules,
we would want to apply to this interface.
So would I apply just the community rules.
Do I want to apply any of the emerging threat rules for now.
Let's just enable the community rules after hitting save,
we can go look at him and it shows a nice easy to read table of each rule
that's in the community rule set and it tells us if it's enabled or disabled
and then we can go in and modify those behaviors.
We can enable them all,
we can disable them all or we can go in one by one
and either enable or disable them.
And then also we can control the variables here.
So we can define our home net, r http servers, so on and so forth.
To give snort a little bit better context around the traffic that it sees.
We can control the pre processors here,
which we will definitely be talking about later on in the course.
But this is a great way to explore some of the pre processors that are
available and then we can control the IP reputation list and everything
like that for this particular interface.
This is awesome because it gives us such granular control
over the capabilities of snort with each individual
interface on the Pf sense firewall.
So this integration is really cool and it's very powerful
and then after we configure the interface,
all we have to do is select start and snort starting for us