Suricata on Backup PFSense give me alerts
-
Hi , i have two vm's PFSense on esx , and config HA that works fine (also config sync suricata on Master)but suricata on both master and backup pfsense gives me alerts , is this right ? what should I do to receive alerts on Master pfsense only?
Thank you -
@farazb59 If you’re running it on WAN it runs outside the firewall so is likely bots scanning your IPs.
-
@SteveITS Thanks for answer but no it's between Server Farm and DMZ its inside traffic.
-
@farazb59 what alerts are triggering? As mentioned previously it’s running outside of pfsense so there are packets going to the secondary
-
@michmoor Trrafic is from server farm to dmz with local ip address the alerts is "Suricata stream closewait fin out of window" between many server's in server farm and lan side interface dmz server . i have a two interfaces in dmz server's for lan and wan side
src 172.16.1.4:1433. dst 172.16.12.14: random port
Thank you
-
Suricata puts the interface it is running on in promiscuous mode so that it sees all traffic on the segment, not just traffic destined for that particular NIC (note this generalization ignores filtering any upstream Ethernet switch might be doing at Layer 2).
Suricata also sits outside the firewall engine. The packet flow for inbound traffic is from the NIC to Suricata and then to the firewall engine. Outboud traffic is just opposite: from the firewall engine to Suricata and then the NIC.
If you want to receive alerts only from the master, then you will need to turn off Suricata on the secondary. Then upon failover you would need to manually start Suricata.
The NIC in the secondary is sitting there receiving traffic and forwarding it to the kernel. The kernel just does not act upon it if the firewall is in standby secondary mode. But Suricata will see the traffic as it comes off the NIC, thus it will log what it sees. It is totally ignorant of "primary" versus "secondary". It's just a dumb packet sniffer seeing traffic, so it analyzes and logs it.
-
@farazb59 The “stream” events ruleset seems to generate a lot of false positives. Consider just turning it off, which is what we do.
Curious how any traffic goes through the secondary, if it hasn’t become master?
