This document describes how to identify unknown risks beyond access control rules, perform intrusion prevention rule detection on the north-south traffic, and prevent vulnerabilities in Cloud Virtual Machine (CVM) from being exposed to the Internet through the intrusion prevention feature.

Operation Guide

Enabling Threat Intelligence

1. After threat intelligence is enabled, CFW forwards protection traffic to the threat intelligence detection and analysis engine to identify unknown risks beyond access control rules.

• Log in to the CFW console. In the left sidebar, select Intrusion Prevention to go to the Intrusion Prevention page.
• On the Intrusion Prevention page, click the icon next to Threat Intelligence to enable this feature.
• After threat intelligence is enabled, CFW forwards protection traffic to the threat intelligence detection and analysis engine to identify unknown risks beyond access control rules.
• External malicious access: CFW monitors and identifies external access to cloud assets from malicious IP addresses and threat samples, such as malicious scans, brute force cracking, mining trojans, ransomware attacks, and remote control.
• Proactive outgoing access: CFW monitors and identifies proactive outgoing access from cloud assets to external malicious IP addresses or domain names, and determines potential host compromise risks through the comparative analysis of big data provided by threat intelligence.

Enabling Basic Prevention

1. Log in to the CFW console. In the left sidebar, click Intrusion Prevention to go to the Intrusion Prevention page.

2. On the Intrusion Prevention page, find the Basic Prevention module and click View Rules to pop up the Basic Prevention Rules window.

3. In the Basic Prevention Rules pop-up window, view the IPS rule list. You can click any rule ID to view its corresponding description.

4. Click to enable or disable the rule for NAT and VPC firewalls.

   Note

   If the versions of some firewall engines are too early, the prevention rules that rely on later engine versions will not take effect for earlier versions of firewall instances. However, basic prevention rules may still remain effective.

5. In the Current Action column, select the action after a rule is hit. Rule actions take effect only for the assets whose protection mode is the interception mode.

   Note

   Custom intrusion prevention rules only take effect for NAT Firewall and VPC boundary firewalls. If the versions of some firewall engines are too early, the custom intrusion prevention rules will not take effect for the corresponding firewalls.

6. For all IPS rules, provide keyword searching, one-click reset, and batch operations.

• Keyword searching: You can query the corresponding rules based on rule attributes, and then configure the toggle status and handling actions.
• One-click reset: You can restore the toggle status of all rules with one click and change a rule action to the default action to make the corresponding rule take effect immediately.
• Batch operations: You can select multiple rules and enable or disable them or change their handling actions in batches.

7. After viewing the rules, click in the Basic Prevention module to enable this feature.

   Note:

   • After Basic Prevention is disabled, all basic prevention rules no longer take effect.
   • In interception mode, malicious behaviors that hit high-confidence rules are automatically intercepted, and security event alarms are generated when other rules are hit.

Enabling Virtual Patching

1. Log in to the CFW console. In the left sidebar, click Intrusion Prevention to go to the Intrusion Prevention page.
2. On the Intrusion Prevention page, find the Virtual Patching module and click View Rules to pop up the Virtual Patching Rules window.
3. For specific rule operations, see the preceding basic prevention rules.
4. Click in the Virtual Patching module to enable this feature.

Protection Mode Description

1. Log in to the CFW console. In the left sidebar, click Intrusion Prevention to go to the Intrusion Prevention page.
2. On the Intrusion Prevention page, locate the Protection Mode module to configure the protection mode.
3. Protection modes include the observation mode, interception mode, and strict mode.

   Note

   The observation mode is used by default.

• If you select Observation Mode, threat intelligence, basic prevention, and virtual patching are all in detection mode. For malicious access or network attack behaviors detected, only alarms are generated, but connections will not be automatically blocked.
• If you select Interception Mode, high-confidence network attacks or malicious access will be automatically intercepted. Threat intelligence supports the automatic interception of outbound malicious access. Basic prevention supports the automatic interception of high-confidence rule alarms. Virtual patching supports the automatic interception of traffic detected as vulnerability exploits.
• If you select Strict Mode, threat intelligence (except the threat intelligence detection for outbound domain names), basic prevention, and virtual patching are all in global interception mode. For any detected alarms, connections are automatically blocked but false positives may be generated. This mode is suitable for important period guarantee or attack and defense scenarios.

Feature Dynamic Description

1. Log in to the CFW console. In the left sidebar, click Intrusion Prevention to go to the Intrusion Prevention page.
2. On the right side of the Intrusion Prevention page, view the feature dynamics and feature descriptions:

• Feature Dynamic: In the Feature Dynamic module, you can view the features of the intrusion prevention module.

Managing the Blocklist (IPS Blocklist) and Allowlist Policy

1. Log in to the CFW console. In the left sidebar, click Intrusion Prevention to go to the Intrusion Prevention page.
2. On the Intrusion Prevention page, view the blocklist and allowlist policy.

Blocklist

Viewing the Blocklist

Click Blocklist to go to the Blocklist tab.

Disabling the Blocklist

In case of emergency, click to disable the Enable Blocklist switch to disable the blocklist.

Managing the Effective Time of the Blocklist

When an IP address in the blocklist expires, the IP address is automatically deleted from the list, and subsequent access traffic of the IP address will not be blocked by the firewall. To prevent IP addresses with security risks from being deleted automatically from the blocklist, click Edit in the Operation column on the right side of the list to modify the expiration time of target IP addresses.
Note: For IP addresses in the blocklist, all traffic passing through CFW in the outbound or inbound direction is blocked and recorded in Intrusion Prevention Logs under Log Audit.

Allowlist Policy

Viewing the Allowlist Policy

Click Allowlist Policy to go to the Allowlist Policy tab.

Note:

The IPS feature is bypassed for IP addresses in the allowlist policy.

Managing the Allowlist Policy Effective Time

When an IP address in the allowlist policy expires, the IP address is automatically deleted from the list, and subsequent access of the IP address will not bypass the IPS feature of the firewall. To prevent trusted IP addresses from being deleted automatically from the allowlist, click Edit in the Operation column on the right side of the list to modify the end time and date of the target IP addresses.