Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
New Member

IPS not detecting malicious traffic in the outbound direction

I have a 4240 running IPS 6.0. I have an interface in promiscuous mode that is connected to a port that has SPAN enabled on the uplink from a switch to my router. I'm doing some testing and noticed that when using nmap from a host located on the inside to a host on a remote subnet that requires me to send my traffic through the uplink port crossing the interface the IPS is monitoring in an outbound direction, no signatures are triggered. However, if I do the same scan reversing the location of the attacker and victim so the scan comes inbound the sensor immediately picks up the scan and triggers the appropriate signatures. Why would this behavior occur and is there a way to change it?

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: IPS not detecting malicious traffic in the outbound directio

Do any other signatures fire on "outbound" traffic. Anything at all?

The very first thing that popped into my mind was that you might only have span set such that your span destination port is only seeing the receive traffic and not the transmit traffic. This is only a guess since I don;t have any details here.

Before we can even really begin to consider the why, we need some details.

What switch model (in case there's some limitation to the span config).

What's the span config.

How are you running nmap (what options).

What alerts fire for you on the reverse direction.

2 REPLIES
Cisco Employee

Re: IPS not detecting malicious traffic in the outbound directio

Do any other signatures fire on "outbound" traffic. Anything at all?

The very first thing that popped into my mind was that you might only have span set such that your span destination port is only seeing the receive traffic and not the transmit traffic. This is only a guess since I don;t have any details here.

Before we can even really begin to consider the why, we need some details.

What switch model (in case there's some limitation to the span config).

What's the span config.

How are you running nmap (what options).

What alerts fire for you on the reverse direction.

New Member

Re: IPS not detecting malicious traffic in the outbound directio

that's great, you nailed it. I've had span setup a while on there for a packet sniffer and was sure I was monitoring traffic in both directions...until I checked the session, it was only looking at receive. Once I changed it to both the signatures began firing as expected. Thank you very much!

165
Views
0
Helpful
2
Replies
CreatePlease to create content