README.multipleconfigs

Description:

Snort now supports multiple configurations based on VLAN Id or IP subnet within a single instance of Snort. This will allow administrators to specify multiple snort configuration files and bind each configuration to one or more VLANs or subnets rather than running one Snort for each configuration required. Each unique snort configuration file will create a new configuration instance within snort. VLANs/Subnets not bound to any specific configuration will use the default configuration. Each configuration can have different preprocessor settings and detection rules.

Creating Multiple Configurations:

Default configuration for snort is specified using the existing -c option. A default configuration binds multiple vlans or networks to non-default configurations, using the following configuration line:

config binding: vlan config binding: net config binding: policy_id

: Refers to the absolute or relative path to the snort.conf for specific configuration. : Refers to the comma separated list of vlandIds and vlanId ranges. The format for ranges is two vlanId separated by a "-". Spaces are allowed within ranges. Valid vlanId is any number in 0-4095 range. Negative vland Ids and alphanumeric are not supported. : Refers to ip subnets. Subnets can be CIDR blocks for IPV6 or IPv4. A maximum of 512 individual IPv4 or IPv6 addresses or CIDRs can be specified. : Refers to the comma separated list of 16bit policyIds NOTE: Vlan and Subnets can not be used in the same line. Configurations can be applied based on either Vlans or Subnets not both. Configuration Specific Elements: =============================== Config Options: ============== Generally config options defined within the default configuration are global by default i.e. their value applies to all other configurations. The following config options are specific to each configuration. policy_id policy_mode policy_version The following config options are specific to each configuration. If not defined in a configuration, the default values of the option (not the default configuration values) take effect. config checksum_drop config disable_decode_alerts config disable_decode_drops config disable_ipopt_alerts config disable_ipopt_drops config disable_tcpopt_alerts config disable_tcpopt_drops config disable_tcpopt_experimental_alerts config disable_tcpopt_experimental_drops config disable_tcpopt_obsolete_alerts config disable_tcpopt_obsolete_drops config disable_ttcp_alerts config disable_tcpopt_ttcp_alerts config disable_ttcp_drops Rules: ===== Rules are specific to configurations but only some parts of a rule can be customized for performance reasons. If a rule is not specified in a configuration then the rule will never raise an event for the configuration. A rule shares all parts of the rule options, including the general options, payload detection options, non-payload detection options, and post-detection options. Parts of the rule header can be specified differently across configurations, limited to: Source IP address and port Destination IP address and port Action A higher revision of a rule in one configuration will override other revisions of the same rule in other configurations. Variables: ========== Variables defined using "var", "portvar" and "ipvar" are specific to configurations. If the rules in a configuration use variables, those variables must be defined in that configuration. Preprocessors: ============== Preprocessors configurations can be defined within each vlan or subnet specific configuration. Options controlling specific preprocessor memory usage, through specific limit on memory usage or number of instances, are processed only in default policy. The options control total memory usage for a preprocessor across all policies. These options are ignored in non-default policies without raising an error. A preprocessor must be configured in default configuration before it can be configured in non-default configuration. This is required as some mandatory preprocessor configuration options are processed only in default configuration. Events and Output: ================== An unique policy id can be assigned by user, to each configuration using the following config line: config policy_id: : Refers to a 16-bit unsigned value. This policy id will be used to identify alerts from a specific configuration in the unified2 records. NOTE: If no policy id is specified, snort assigns 0 (zero) value to the configuration. To enable vlanId logging in unified2 records the following options can be used. output alert_unified2: vlan_event_types (alert logging only) output unified2: filename , vlan_event_types (true unified logging) : Refers to the absolute or relative filename. vlan_event_types : When this option is set, snort will use unified2 event type 104 and 105 for IPv4 and IPv6 respectively. Events NOTE: Each event logged will have the vlanId from the packet if vlan headers are present otherwise 0 will be used. How Configuration is applied? ============================ Snort assigns every incoming packet to a unique configuration based on the following criteria. If VLANID is present, then the innermost VLANID is used to find bound configuration. If the bound configuration is the default configuration, then destination IP address is searched to the most specific subnet that is bound to a non-default configuration. The packet is assigned non-default configuration if found otherwise the check is repeated using source IP address. In the end, default configuration is used if no other matching configuration is found. For addressed based configuration binding, this can lead to conflicts between configurations if source address is bound to one configuration and destination address is bound to another. In this case, snort will use the first configuration in the order of definition, that can be applied to the packet.