Network intrusion prevention by configuring ACLs on the routers, based on snort IDS alerts

Abstract

Intrusion prevention is one of the fundamental requirements for a network to be secure. Investing on intrusion prevention forbade its use for securing many networks. This study proposes a very basic way to prevent intrusions without any additional cost. Snort is a free open source IDS, which we have integrated with a Cisco router to prevent intrusions. Cisco routers are very common in today's networks. Other routers like Juniper, or even simple ADSL or SOHO routers can be used but with minor changes for the router specific configuration. As ADSL is very common nowadays, ADSL routers are present everywhere and they can easily replace the Cisco router used in this study and provide intrusion prevention capabilities for homes and businesses which otherwise are not able to afford it. Router and computer (to be used as a sensor) are fundamental components of every major network, so, the proposed system does not need any additional hardware. Snort is used as an IDS and alerts are logged to a database from where they are read and router Access Control List (ACL) rules are generated based on Snort intrusion alerts and then these ACL rules are configured on the router to block the potential intrusions. Method for removing ACL rules is also proposed, which may be required under some circumstances. In a fine tuned Snort IDS, false alarms will be minimum and most of the alerts will indicate intrusions. Hence, proposed system can work best to prevent intrusions with a fine tuned Snort IDS.