UniFi Gateway - Intrusion Detection and Prevention (IDS/IPS)

UniFi's Intrusion Prevention and Detection system (IDS/IPS) is a critical components designed to enhance your network security. This systems serves as a frontline defense, identifying and mitigating threats before they can cause harm.

What is Intrusion Detection and Prevention?

• Intrusion Detection System (IDS): Monitors network traffic for suspicious activity and alerts administrators.
• Intrusion Prevention System (IPS): Similar to IDS but also takes proactive steps to block detected threats.

Why are IPS and IDS Important?

• Threat Detection & Prevention: Identifies malicious traffic, preventing potential damage. Real-time signature updates ensure you are protected against new and evolving threats.
• Continuous Monitoring & Analytics: Provides detailed logs of security events to better understand network trends.
• Compliance: Helps meet security standards and regulatory requirements (PCI-DSS, HIPAA, etc).

What are Threat Signatures?

IDS/IPS works by scanning network traffic for patterns, known as signatures, that indicate known threats. Deep Packet Inspection (DPI) is used to thoroughly examine the contents of data packets at various layers of network communication:

• Layer 3 (Network Layer): IP addresses
• Layer 4 (Transport Layer): Ports and protocols
• Layer 7 (Application Layer): Application payloads

A signature’s matching characteristic may consist of various elements from one or multiple layers, either within a single packet, or multiple packets throughout a communication session. For example, a given signature might look for multiple packets of a specified size being sent from a particular IP address over a specific port. 

UniFi has thousands of signatures, each grouped into distinct threat categories so you can flexibly configure your network to best meet your organizational goals.

Configuring IDS/IPS

To configure IDS/IPS, follow these steps:

1. Navigate to Network Settings > Security > Protection.
2. Toggle on Intrusion Prevention.
3. Select the networks you wish to apply IPS/IDS to
4. Configure the Detection Mode as Notify (IDS) or Notify and Block (IPS)
5. Select the Active Detections you want to apply.

Expanding Threat Signatures with CyberSecure 

CyberSecure is a per-site subscription available that greatly extends the size of UniFi's threat signature database used by Intrusion Detection and Prevention. View the CyberSecure article for more information. 

Responding to a Detection

When a threat is detected, both IPS and IDS will generate email and mobile push alerts. However, IPS will also block the detected threats automatically.

1. View Detections:
   1. Check detections in the System Log located at System Log > Security Detection or the Inspection tab located at Insights > Inspection.
2. Recognize Important Alert Details:
   1. Identify the affected client, threat source IP, protocol, signature, threat category, date/time, and any other relevant information or descriptions.
3. Verify the Threat Details:
   1. Research the Threat Signature: Look for analyses from cybersecurity researchers, or other reputable cybersecurity databases and forums for more detailed information and community insights about the threat.
   2. Determine Expected Traffic: Based on who/what the IP address belongs to, determine if this is expected traffic, and thus likely false positive. Note: Media and gaming traffic are common contributors to false positives
   3. Check the Affected Client: Check the affected client to see if there are obvious signs of it being compromised, such as slowness, lack of responsiveness, or unwanted pop-ups.
   4. Confirm OS Relevance: If the signature is associated with a particular operating system (OS), confirm if your device runs that OS. If not, it's likely a false positive.
4. Respond Accordingly:
   1. Block Connection: Blocks the connection between the specific source and destination by automatically generating a Firewall Rule.
   2. Block Source IP: Blocks all traffic from the source of the threat by automatically generating a Firewall Rule.
   3. Allow Signature: Prevents the associated signature from triggering IPS/IDS by adding it to the Signature Suppression table located in Settings > Security > Intrusion Prevention. 
   4. Exclude Source IP: Prevents the source IP from triggering IPS/IDS by adding it to the Security Detection Allow List located in Settings > Security > Intrusion Prevention.

Testing IDS/IPS

To test IDS/IPS, follow these steps:

1. Set Detection Sensitivity to High
   • Note: This is needed to enable the “Trojan” threat category associated with the test signature.
2. Open a terminal or command prompt on a client connected to the UniFi network.
3. Run the following test command:

   curl -A "BlackSun" http://www.example.com

4. Check System Log > Security Detection for the alert.
   Note: The alert may take a moment before appearing.

FAQs