vSRX + K2 On-Premises

Instructions for deploying vSRX with K2 On-Premises Platform.

Goal

Deploy vSRX in a VPC, K2 On-Prem Portal and K2 Agents on EC2 Instances in that VPC via cloudformation template.

Prerequisites

Steps

Part 1: K2 OnPrem Portal

  • STEP 1: Setup Configuration :

    • Update the following parameters from the sample yml below

      • General Parameters

        • KeyName : Name of an existing EC2 KeyPair to enable SSH access to the instance.

        • AllowedSshIpAddress :Source IP address (CIDR notation) from which SSH to k2cloud instance is allowed.

        • AllowedAddress :Source IP address (CIDR notation) from which any access to k2cloud instance is allowed.

        • InstanceType: Specify instance type, by default it is m5.2xlarge and we recommend the same.

        • SSHLocation: Source IP address (CIDR notation) from which any access to k2cloud instance is allowed.

    • Copy the sample yml below with updated parameters into your EC2 CFT yml

      • Parameters:
  KeyName:
    Description: Name of an existing EC2 KeyPair to enable SSH access to the instance
    Default: cftwest1 #Configurable Section1
    Type: AWS::EC2::KeyPair::KeyName
    ConstraintDescription: must be the name of an existing EC2 KeyPair.
  AllowedAddress:
    Description: Source IP address (CIDR notation) from which any access to vSRXs is allowed
    Type: String
    Default: 0.0.0.0/0
  InstanceType:
    Description: WebServer EC2 instance type
    Type: String
    Default: m5.2xlarge
    AllowedValues: [t2.nano, t2.micro, t2.small, t2.medium, t2.large, t2.xlarge, t2.2xlarge,
      t3.nano, t3.micro, t3.small, t3.medium, t3.large, t3.xlarge, t3.2xlarge,
      m4.large, m4.xlarge, m4.2xlarge, m4.4xlarge, m4.10xlarge,
      m5.large, m5.xlarge, m5.2xlarge, m5.4xlarge,
      c5.large, c5.xlarge, c5.2xlarge, c5.4xlarge, c5.9xlarge,
      g3.8xlarge,
      r5.large, r5.xlarge, r5.2xlarge, r5.4xlarge,
      i3.xlarge, i3.2xlarge, i3.4xlarge, i3.8xlarge,
      d2.xlarge, d2.2xlarge, d2.4xlarge, d2.8xlarge]
    ConstraintDescription: must be a valid EC2 instance type.
  SSHLocation:
    Description: The IP address range that can be used to SSH to the EC2 instances
    Type: String
    MinLength: 9
    MaxLength: 18
    Default: 0.0.0.0/0
    AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})
    ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x.
############################ K2 Configuration #1 Ends Here ############################

  • Step 2: K2Cloud AMI Configuration:

    • Update Mappings part of k2cloud cloudformation template

      • Make sure you have AMI Ids ready after subscription to k2cloud offering on AWS marketplace.

      • Specify AMI Id for respective region, for now you can give AMI Id for particular region and move to the next step.

    • Mappings:
  K2CloudAMIEC2:
    us-east-1:
      CentOS7: ami-0dd3922502962f0ae
    us-west-2:
      CentOS7: ami-b55a51cc
    us-west-1:
      CentOS7: ami-027956be094a99d30
    eu-west-1:
      CentOS7: ami-f1978897
    eu-central-1:
      CentOS7: ami-0e258161
    ap-northeast-1:
      CentOS7: ami-5c9a933b
    ap-southeast-1:
      CentOS7: ami-cb981aa8
    ap-southeast-2:
      CentOS7: ami-9a3322f9

  • Step 3: K2Cloud Deployment

    • It includes following components

      • Launch K2Cloud instance from k2cloud AMI specified above

      • IAM role for S3 Access

      • S3 bucket creation for backup and restore purposes.

    • Resources:
  S3Bucket:
    Type: 'AWS::S3::Bucket'
    Properties:
      BucketName: k2cloud-backup

  EC2InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles: [!Ref 'EC2Role']

  # Role for the EC2 hosts.
  EC2Role:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service: [ec2.amazonaws.com]
          Action: ['sts:AssumeRole']
      Path: /
      Policies:
      - PolicyName: k2cloud-policy
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
              - 's3:AbortMultipartUpload'
              - 's3:GetBucketLocation'
              - 's3:GetObject'
              - 's3:ListBucket'
              - 's3:ListBucketMultipartUploads'
              - 's3:PutObject'
            Resource:
              - arn:aws:s3:::k2cloud-backup
              - arn:aws:s3:::k2cloud-backup/*

  EC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !FindInMap
        - K2CloudAMIEC2
        - !Ref 'AWS::Region'
        - CentOS7
      InstanceType: !Ref 'InstanceType'
      SecurityGroupIds: [{ "Fn::GetAtt" : ["InstanceSecurityGroup", "GroupId"] }]
      KeyName: !Ref 'KeyName'
      IamInstanceProfile: !Ref 'EC2InstanceProfile'
      BlockDeviceMappings:
      - DeviceName: "/dev/sda1"
        Ebs:
          VolumeType: "gp2"
          DeleteOnTermination: true
          VolumeSize: 200
      #SubnetId: !Ref PublicSubnet1
      Tags:
        - Key: Name
          Value: Test
  InstanceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Enable SSH access via port 22
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 22
        ToPort: 22
        CidrIp: !Ref 'SSHLocation'
      - IpProtocol: tcp
        FromPort: 80
        ToPort: 80
        CidrIp: !Ref AllowedAddress
      - IpProtocol: tcp
        FromPort: 8080
        ToPort: 8080
        CidrIp: !Ref AllowedAddress
      - IpProtocol: tcp
        FromPort: 443
        ToPort: 443
        CidrIp: !Ref AllowedAddress

  • Step 4 : Run the template

    • Using AWS Console

    • Using AWS Cli For e.g.

      • aws cloudformation create-stack --region ${REGION_NAME} --stack-name ${PROVIDE_STACKNAME_HERE} --template-body file://${PROVIDE_TEMPLATE_NAME}

      • Example Command is below

      • aws cloudformation create-stack --region us-west-1 --stack-name ec2-k2 --template-body file

Part 2: vSRX installation (This is a sample and you should use your own vSRX installation CFT)

  • STEP 1: vSRX Configuration :

    • Update the following parameters in the sample yml below

      • General Parameters

        • KeyName : Name of an existing EC2 KeyPair to enable SSH access to the instance.

        • AllowedSshIpAddress : Source IP address (CIDR notation) from which SSH to vSRXs is allowed.

        • AllowedAddress : Source IP address (CIDR notation) from which any access to vSRXs is allowed.

        • TerminationProtection: Enable termination protection on the VSRX EC2 instances to avoid accidential VSRX termination?.

      • vSRX Parameters

        • VpcCidr : CIDR block for vSRX VPC.

        • PubSubnet1 : Address range for vSRX VPC management subnet.

        • PubSubnet2 : Address range for vSRX VPC data subnet to be created in AZ1.

        • PriSubnet1 : Address range for vSRX VPC private subnet to be created in AZ1.

        • VSRXType : Virtual machine size required for VSRX instances.

      • AMIID Mappings

        • Mappings : Update the mappings and specify the AMI Id for vSRX.

    • Copy the sample yml below and update the parameters and use them in final yml

  • Step 2: Installation of vSRX :

    • Following CFT yml will include :

      • vSRX Network Infrastructure Provisioning

      • vSRX EC2 Instance Provisioning

  • Step 3: Once your template is ready and valid, Run it via EC2 console or AWS CLI

    • Commands to run

      • Using AWS Console

      • Using AWS Cli For e.g.

        • Example Command is below

  • Step 4: Create policy shell script as per your use case and apply them on vSRX instance, for more details checkout the Complete Example.

Part 3: Installation of K2 agents on EC2 instances

  • Step 1: K2-SaaS Setup on EC2 instance where Web application runs:

    • Update the following parameters from the sample yml below

      • General Parameters

        • KeyName : Name of an existing EC2 KeyPair to enable SSH access to the Ec2 instance.

        • InstanceType : WebServer EC2 instance type.

      • K2 Parameters

        • k2IsDocker : Set docker or non docker install of K2 agents, true for docker install and vice versa.

        • k2IsPrivileged : Set privileged mode installation of K2 agents, true for privileged mode and vice versa.

        • k2VersionNumber : Set the K2 agents version for download for e.g. 1.10.10

        • k2CustomerId : Set your K2 customer Id for e.g. 1101

        • k2TempToken : Set the temp token for K2 agents tarball download, You can get it from K2 Manager UI.

        • k2CloudIP : Provide here K2 On Prem Portal Elastic IP obtained after cft deployment in part1.

      • AMIID Mappings

        • Mappings : Update the mappings and specify the AMI Id for K2 Demo Instance.

  • Step 2: Installation of K2 Agents on the EC2 instance

    • Following CFT yml will include :

      • CFN Helper Scripts provisioning

      • K2 Agents Installation

  • Step 3: Once your template is ready and valid, Run it via EC2 console or AWS CLI

    • Commands to run

      • Using AWS Console

      • Using AWS Cli For e.g.

        • Example Command is below

  • Step 4: Verification

    • Two EIPs will be attached to vSRX Instance

      • Revenue Data EIP : A Revenue port is used for traffic processing. You can access the vulnerable app through revenue data elastic ip of vsrx instance (http://${REVENUE_DATA_IP}:8080).

        • SSH to secondary instance behind vSRX instance using revenue data ip.

      • Management EIP : The management interface is preconfigured with the AWS Elastic IP and default route. You can login to vSRX instance using Management IP and verify all the vSRX policies are set fine.

        • Login to vSRX instance

        • Go to configuration mode

        • Check all the security policies applied to vSRX instance

  • Step 5: Attack Detection

    • On the Vulnerable Application, there is broad category of attacks availible, you can launch one of the attacks like File based, Remote code, SQL Injection etc.

    • Access K2 SaaS portal (https://k2io.net/centralmanager ) and sign in with your username and password.

    • Attack detected would be shown in the attacks tab of K2 SaaS portal.

Part 4 : Configure vSRX policies using K2Manager

Step 1 : Open Firewall Integration

Go to Settings tab and go to Firewall Integration in dropdown list of Settings.

​Firewall | K2 Portal

Step 2 : Add a new Firewall Configuration Rule

Add a new Firewall Configuration Rule

  • Click on + on right side of the Firewall Integration view to add new firewall configuration

  • Configure the following attributes:

    • Firewall IP : vSRX controller IP

    • Username: SSH user (Used to SSH to vSRX controller instance)

    • Password: SSH password (Used to SSH to vSRX controller instance)

    • Update Interval: Periodic interval at which the xSRX controller pulls the information from K2

    • SNAT Enabled: True (For static NAT)​

Step 3 : Add Blocking List Configurations

Step 4 : Add Allowed List Configurations​

Complete Template Example

Make sure Part 1 of step is done to install K2 Portal On-Premises.

This complete example is combination of Part2, Part3 and Part4 of steps mentioned above.

Following steps will show how to deploy vSRX in a VPC and K2 Agents on EC2 Instances in that VPC via cloudformation template.

Cloudformation Template :

Setup and Configure parameters in below template as per you environment :

  • KeyName : Name of an existing EC2 KeyPair to enable SSH access to the instance.

  • AllowedSshIpAddress : Source IP address (CIDR notation) from which SSH to vSRXs is allowed.

  • AllowedAddress : Source IP address (CIDR notation) from which any access to vSRXs is allowed.

  • TerminationProtection: Enable termination protection on the VSRX EC2 instances to avoid accidential VSRX termination?.

  • VpcCidr : CIDR block for vSRX VPC.

  • PubSubnet1 : Address range for vSRX VPC management subnet.

  • PubSubnet2 : Address range for vSRX VPC data subnet to be created in AZ1.

  • PriSubnet1 : Address range for vSRX VPC private subnet to be created in AZ1.

  • VSRXType : Virtual machine size required for VSRX instances.

  • K2DemoInstanceType : WebServer EC2 instance type.

  • k2IsDocker : Set docker or non docker install of K2 agents, true for docker install and vice versa.

  • k2IsPrivileged : Set privileged mode installation of K2 agents, true for privileged mode and vice versa.

  • k2VersionNumber : Set the K2 agents version for download for e.g. 1.10.10

  • k2CustomerId : Set your K2 customer Id for e.g. 1101

  • k2TempToken : Set the temp token for K2 agents tarball download, You can get it from K2 Manager UI.

  • Mappings : Update the mappings and specify the AMI Id for vSRX and k2demo machine respectively

VSRX.yml

vsrx-policies.sh

K2-SAAS.yml

  • Go through all the parameters and define their default values as per your setup or pass them in cloudformation command in VSRX.yml and K2-SAAS.yml

  • Provide AMIID in Mappings section as per region, you can only change one region also for your deployment.

  • Save the file as mentioned names.

  • Run them in below sequence

    • VSRX.yml

    • vsrx-policies.sh

    • K2-SAAS.yml

  • Commands to run

    • Using AWS Console

    • Using AWS Cli For e.g.

      • Example Command is below

  • Access the Vulnerable app through revenue data elastic ip of vsrx instance

End to End Verification

Generate an attack from the Vulnerable Application.

Link: http://<REVENUE_ELASTIC_IP>:8080

K2 Vulnerable Applications UI

K2M Firewall Blocked List On K2 UI: Settings → Firewall Integration → Blocked List Link: https://www.k2io.net/centralmanager/#!/app/settings/firewall

The attacker IP is detected and added to the blocked list, which can be viewed on K2 UI.

This IP list is regularly pulled by vSRX which enables the firewall to block any further requests to the application.

  1. Link: Settings → Firewall Integration → Blocked List (https://www.k2io.net/centralmanager/#!/app/settings/firewall )

  1. Visit the Vulnerable Application and it should not be accessible.

    1. Note: The IP will be removed from the blocked list after 2 hours and if you wish you can remove it yourself.

PreviousvSRX + K2 SaaSNextSIEM

Last updated

Was this helpful?