[Snort-users] Snort production setup design

Stephen Gantz stephen.gantz at ...16854...
Thu Dec 17 14:43:51 EST 2015


I suppose you could deploy multiple Snort instances with an elastic load balancer in front to them. Works great for web servers so I don't know why it wouldn't work for IDS sensors. 

Dr. Stephen D. Gantz
CISSP-ISSAP, CEH, CGEIT, CRISC, CIPP/G, C|CISO
Professor of Information Assurance
The Graduate School
University of Maryland University College
stephen.gantz at ...16854...

> On Dec 17, 2015, at 12:43 PM, Steven Dracker <steven at ...17402...> wrote:
> 
> How would you make this setup HA? Looking to avoid the single point of failure.
>  
> Thanks,
> Steven
>  
> From: Stephen Gantz [mailto:stephen.gantz at ...16854...] 
> Sent: Thursday, December 17, 2015 12:35 PM
> To: Steven Dracker <steven at ...17402...>
> Cc: sandeep dubey <sandeep.sanash at ...11827...>; Rodgers, Anthony (DTMB) <RodgersA1 at ...17120...>; snort-users at lists.sourceforge.net
> Subject: Re: [Snort-users] Snort production setup design
>  
> You should be able to implement Snort as an inline IDS in your VPC by adding a Linux instance with two network interfaces. Install Snort on that and configure your routing tables and AWS security groups to direct all traffic to one interface on the Snort instance, and all downstream devices to receive traffic from the other interface. You can set up IP tables to handle the inbound and outbound flow through Snort just as you would on a physical dual-interface box. 
> 
> Dr. Stephen D. Gantz
> CISSP-ISSAP, CEH, CGEIT, CRISC, CIPP/G, C|CISO
> Professor of Information Assurance
> The Graduate School
> University of Maryland University College
> stephen.gantz at ...16854...
> 
> On Dec 17, 2015, at 9:39 AM, Steven Dracker <steven at ...17402...> wrote:
> 
> I noticed on the GitHub Security Onion Wiki that it requires a Span Port - “For a production deployment, you'll need a tap or SPAN/monitor port. Here are some inexpensive tap/span solutions:”. These solutions look like they are not compatible with AWS.
>  
> My findings are that AWS does not support Span, Tap or Mirror on their network layer to get a copy of traffic to inspect which is needed for Network IDS. so I am confused as to how this solution could be deployed for NIDS on AWS. Same thing holds true for Snort.
>  
> I have only been successful finding Host Based IDS solutions for AWS which require an Agent on each node. Either they do the IDS analysis on the node itself or do a “soft-tap” on the host’s network adapter (Not at the VPC Perimeter) and pass it to an IDS manager.
>  
> How do you do inline HIDS on AWS is my question. I am coming up with a lot of the same questions out there but no answers.
>  
> Thanks,
> Steve
>  
>  
> From: sandeep dubey [mailto:sandeep.sanash at ...11827...] 
> Sent: Thursday, December 17, 2015 9:09 AM
> To: Rodgers, Anthony (DTMB) <RodgersA1 at ...17120...>
> Cc: snort-users at lists.sourceforge.net
> Subject: Re: [Snort-users] Snort production setup design
>  
> Thanks Rodgers for reply,
>  
> I am running my production environment on public cloud Amazon Web Services (AWS), where i don't have control for installing iso/img etc. 
>  
> Is SecurityOnion equivalent to OSSIM ?
>  
> On Thu, Dec 17, 2015 at 7:03 PM, Rodgers, Anthony (DTMB) <RodgersA1 at ...5975...120...> wrote:
> Can’t recommend SecurityOnion highly enough.
>  
> --
> Anthony Rodgers
> Security Analyst
> Michigan Security Operations Center (MiSOC)
> DTMB, Michigan Cyber Security
>  
> From: sandeep dubey [mailto:sandeep.sanash at ...11827...] 
> Sent: Thursday, December 17, 2015 04:53
> To: snort-users at lists.sourceforge.net
> Subject: [Snort-users] Snort production setup design
>  
> Hi, 
>  
> Is it possible to install snort in IDS mode on multiple servers (AWS EC2 instances ) and have a central server where analysis can be done through gui and also alerts/notification can be managed like OSSEC ? 
>  
> If yes, what is the tools to use and how to move ahead?
>  
> --
> Regards,
> Sandeep
> 
> 
>  
> --
> Regards,
> Sandeep
> ------------------------------------------------------------------------------
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> 
> Please visit http://blog.snort.org to stay current on all the latest Snort news!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20151217/0077800a/attachment.html>


More information about the Snort-users mailing list