Friday 15 March 2019

use regular expressions to find IP addresses

Good site for building regular expressions
https://regexr.com/

How to find IP the quick way and the exact way
https://www.regular-expressions.info/ip.html

Find IP (this will find 999.999.999.999 but you might not care
\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b

Below I was looking for 192.168.x.x
(192.168.)\d{1,3}\.\d{1,3}

Notes:
\b allows you to perform a "whole words only" search using a regular expression in the form of \bword\b. A "word character" is a character that can be used to form words. All characters that are not "word characters" are "non-word characters".

\d look for a digit

\d{1,3} look for between 1 to 3 digits

(192.168.) look for a group "192.168."


Example 1
Look for some thing with any character "." 
that is 1 or more long "{1,}"
followed by a new line (\n)
followed by any number of white space "(\s+)"
followed by IP address (simple) "(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

(.{1,})(\n)(\s+)(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})


White space characters
\t (tab)
\n (newline)
\s (any white space)
\s+ (any number of white space) 

Example 2
Looks for something(word) with any character 1 or more
any white space
IP address 

(.{1,})(\s)(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})

Capture groups
(\n)(\t)
$1 = newline
$2 = tab

Wednesday 13 March 2019

configure firepower FTD in CLI

Patch your mgmt port and LAN port to the same lan/vlan

Give the management interface an IP address followed by the subnet mask and the gateway
configure network ipv4 manual 192.168.100.200 255.255.255.0 192.168.100.254

Add the manager (FMC)
configure manager add 192.168.100.253 123456

Now go to FMC and  add the sensor (192.168.100.200)

You might need to add a route for the network on the FMC under System -> configuration -> Management interfaces


disable http2 on cisco firepower FTD/FMC for ssl decryption

I tired to setup SSL decryption following the documentation from Cisco.

I was getting an error in the browser ERR_SSL_VERSION_INTERFERENCE

This is because the FTD tells the web server that it supports http2 which it actually doesn't so you have to disable that and use http1.1

From Cisco TAC:

Here is the command regarding disabling HTTPv2.0 on firepower:
> system support ssl-client-hello-tuning extensions_remove 16,13172
Then you need to restart snort using following command on expert mode, this will cause network outage for a few seconds
>expert
# sudo pmtool restartbytype snort