Install IDPS

Install IDPS

To install IDPS on a VM:

  1. Configure network interfaces. For example:

    #The loopback network interface
    auto lo
    iface lo inet loopback
    #The internal network interface
    auto eth0
    iface eth0 inet dhcp
    #The external network interface
    auto eth1
    iface eth1 inet dhcp
    #The management network interface (recommended)
    auto eth2
    iface eth2 inet dhcp
  2. Install Suricata IDPS.


    To enable NFQUEUE for IPS mode, install Netfilter packages and configure Suricata with --enable-nfqueue option before build. See the IPS mode with NFQUEUE section below for steps.

  3. To capture traffic as it comes to a NIC avoiding packets reassembling by a network adapter, turn off offloads for a network interface you want to sniff. For example, configure eth0 with ethtool as root:

    ethtool -K eth0 rx off tx off sg off tso off gso off rxvlan off txvlan off gro off lro off


    If offloads are enabled, this may lead to reassembling incoming packets that results in changing packet structure and increasing its size. Suricata may not process reassembled packets correctly. If GRO and LRO are enabled, you will see the error message when launching Suricata:

    [ERRCODE: SC_ERR_PCAP_CREATE(21)] - Using Pcap capture with GRO or LRO
    activated can lead to capture problems.
  4. To extract files over 1 Mb in size from HTTP traffic, increase a value of the stream engine option stream.reassembly.depth (default is 1 Mb), which controls the depth into a stream in which Suricata looks, or set to 0 for no limit in suricata.yaml.

You can run IDPS in two modes based on a service type:

  • IDS (Contrail’s Analyzer)

    Analyzing traffic and generating alerts.

  • IPS or inline (Contrail’s Firewall)

    Blocking or modifying packets and generating alerts.

You can deploy IDPS in two ways based on a service mode:

  • As a router (Contrail’s In-Network)

    IDS or IPS is placed between at least two networks and packets are routed.

  • As a bridge (Contrail’s Transparent)

    IDS or IPS forwards packets between network interfaces without modification.