The C&C feed lists devices that attempt to contact
a C&C host. If an outbound request to a C&C host is attempted,
the request is blocked and logged or just logged, depending on the
configuration. Currently, you configure C&C through CLI commands
and not through the Web interface.
To create the C&C profile and policy and firewall
policy:
- Configure the C&C profile. In this example the profile
name is
cc_profile and threat levels 8 and above are blocked.root@host# set services security-intelligence profile cc_profile category CC
root@host# set services security-intelligence profile cc_profile rule CC_rule match threat-level [8
9 10]
root@host# set services security-intelligence profile cc_profile rule CC_rule then action block drop
root@host# set services security-intelligence profile cc_profile rule CC_rule then log
root@host# set services security-intelligence profile cc_profile default-rule then action permit
- Verify your profile is correct using the
show services
security-intelligence CLI command. Your output should look similar
to this.root@host# show services security-intelligence profile cc_profile
category CC;
rule CC_rule {
match {
threat-level [ 8 9 10 ];
}
then {
action {
block {
drop;
}
}
log;
}
}
default-rule {
then {
action {
permit;
}
log;
}
}
- Configure your C&C policy to point to the profile
created in Step 1. In this example, the C&C policy name is
cc_policy.root@host# set services security-intelligence policy cc_policy CC cc_profile
- Verify your policy is correct using the
show services
security-intelligence CLI command. Your output should look similar
to this.root@host# show services security-intelligence policy cc_policy
CC {
cc_profile;
}
[edit]
- Configure the firewall policy to include the C&C policy.
This example sets the trust-to-untrust zone.
root@host# set security policies from-zone trust to-zone untrust policy p2 match source-address any destination-address any application any
root@host# set security policies from-zone trust to-zone untrust policy p2 then permit application-services security-intelligence-policy cc_policy
- Verify your command using the
show security policies CLI command. It should look similar to this:root@host# show security policies
...
from-zone trust to-zone untrust {
policy p2 {
match {
source-address any;
destination-address any;
application any;
}
then {
permit {
application-services {
security-intelligence-policy cc_policy;
}
}
}
}
}
...
[edit]
- Commit your changes.
