Skip to main content
Versa Networks

Configure Custom Signatures

  1. Last updated
  2. Save as PDF

Versa-logo-release-icon.pngFor supported software information, click here.

To configure custom signatures, you upload intrusion prevention system (IPS) signature files in .zip or .rules format, and then publish them to push the files to all SASE gateways on which the tenant is present. The Concerto node then automatically activates the custom signature files.

For information about creating IPS signature files, see Configure Intrusion Detection and Prevention.

To configure custom signatures:

  1. Go to Configure > Security Service Edge > Real-Time Protection > Profiles.

    Real-time-protection-Profiles-left-nav-border.png

    The following screen displays.

    custom-signatures-dashboard-v2-border.png
     
  2. Select the Malware Protection & IPS > Custom Signatures tab, and then click upload-icon-blue-22.png Upload File. The Upload File popup window displays.

    Note: In Release 12.2.2, the Custom Signatures subtab was moved under the new Malware Protection & IPS tab.

    upload-file-custom-signature-rules-border.png
  3. Enter a filename in the File Name field, or click Browse to select a file to upload. The file must in .zip or .rules format.
  4. Click Upload to upload the file. You can upload multiple files.
  5. In the main Custom Signatures screen, click Publish to push all the uploaded custom signature files to all the SASE gateways on which the tenant is present.

Examples of Custom IPS Signatures

A signature on the Encrypted Client Hello (ECH) extension alone cannot be used to block. Chrome and Firefox send a dummy ECH extension on every connection, so blocking on it would reset most HTTPS. The effective control is to stop the browser from obtaining the ECH key, which comes from the DNS HTTPS record (type 65).

The following three Snort-style IPS signatures are examples of custom IPS signatures.

  • Drop DNS queries for HTTPS/SVCB records (type 65/64) on UDP and TCP 53
alert udp $HOME_NET any -> any 53 (msg:"DNS query HTTPS RR (type 65)"; flow:to_server; byte_test:1,!&,0x80,2;
byte_test:1,!&,0x78,2; content:"|00 01|"; offset:4; depth:2; content:"|00 00 41 00 01|"; offset:12; fast_pattern;
classtype:policy-violation; sid:9000001; rev:2;)
alert udp $HOME_NET any -> any 53 (msg:"DNS query SVCB RR (type 64)"; flow:to_server; byte_test:1,!&,0x80,2;
byte_test:1,!&,0x78,2; content:"|00 01|"; offset:4; depth:2; content:"|00 00 40 00 01|"; offset:12; fast_pattern;
classtype:policy-violation; sid:9000002; rev:1;)
alert tcp $HOME_NET any -> any 53 (msg:"DNS/TCP query HTTPS RR (type 65)"; flow:to_server,established; byte_test:1,!&,0x80,4;
byte_test:1,!&,0x78,4; content:"|00 01|"; offset:6; depth:2; content:"|00 00 41 00 01|"; offset:14; fast_pattern;
classtype:policy-violation; sid:9000003; rev:1;)
alert tcp $HOME_NET any -> any 53 (msg:"DNS/TCP query SVCB RR (type 64)"; flow:to_server,established; byte_test:1,!&,0x80,4;
byte_test:1,!&,0x78,4; content:"|00 01|"; offset:6; depth:2; content:"|00 00 40 00 01|"; offset:14; fast_pattern;
classtype:policy-violation; sid:9000004; rev:1;)
  • Drop DNS responses on port 53 carrying the ECH parameter
alert udp any 53 -> $HOME_NET any (msg:"DNS response HTTPS RR with ECH config"; flow:to_client; byte_test:1,&,0x80,2; 
content:"|00 41 00 01|"; offset:12; content:"|00 05|"; distance:0; content:"|fe 0d|"; distance:4; within:2; fast_pattern; 
classtype:policy-violation; sid:9000005; rev:1;)
alert tcp any 53 -> $HOME_NET any (msg:"DNS/TCP response HTTPS RR with ECH config"; flow:to_client,established; 
byte_test:1,&,0x80,4; content:"|00 41 00 01|"; offset:14; content:"|00 05|"; distance:0; content:"|fe 0d|"; distance:4; 
within:2; fast_pattern; classtype:policy-violation; sid:9000006; rev:1;)
  •  Alert only: ClientHello with ECH extension present 
alert tcp $HOME_NET any -> any 443 (msg:"TLS ClientHello carries ECH extension"; flow:to_server,established; 
content:"|16 03|"; depth:2; content:"|01|"; offset:5; depth:1; content:"|fe 0d|"; fast_pattern; lua:ech_ext_walk.lua; 
classtype:policy-violation; sid:9100010; rev:1;) 
ech_ext_walk.lua (logic; buffer must be the reassembled ClientHello):

Supported Software Information

Releases 12.1.1 and later support all content described in this article, except:

  • In Release 12.2.2, the Custom Signatures subtab was moved under the new Malware Protection & IPS tab.