<div dir="ltr"><div>net.bridge.bridge-nf-filter-<wbr>vlan-tagged = 1<br>net.bridge.bridge-nf-pass-<wbr>vlan-input-dev = 1<br><br><br>In debian based distros, these two sysctl flags need be enabled to allow
IPTABLES to read the 8021q tagged packets on the bridge > Push the
data into Suricata userland > make a decision and if not dropped will
be pushed back out onto the wire on the other bridge interface. If you
don't have these flags enabled, you're not truly scanning 8021q traffic.
You'd only be seeing untagged packets. At least that has been my
experience. I can only offer what I've seen in my fumblings with suricata on a dot1q tagged link. I may
be blowing smoke. :)<br><br></div>I hope what I wrote helped.<br></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, May 30, 2017 at 5:35 PM, Dylan B. Walter <span dir="ltr"><<a href="mailto:DBWalter@goodwilleasterseals.org" target="_blank">DBWalter@goodwilleasterseals.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><table width="100%" border="0" cellpadding="0" cellspacing="0">
<tbody><tr>
<td style="border:1px solid #003e6a" align="center" height="20" bgcolor="#005FA8">
<a href="http://www.zixcorp.com/get-started/" style="text-decoration:none" target="_blank"><font face="ARIAL" color="#FFFFFF"><span style="color:#ffffff;font-family:'Helvetica Neue',Helvetica,Arial,sans-serif;line-height:20px;font-size:13px;white-space:nowrap">This message was sent securely using </span></font><font face="TIMES" color="#FFFFFF"><span style="font-family:Georgia,Times,'Times New Roman',serif;color:#ffffff;font-size:13px;padding:0;white-space:nowrap">Zix</span></font><font face="ARIAL" color="#FFFFFF"><span style="color:#ffffff;font-family:'Helvetica Neue',Helvetica,Arial,sans-serif;font-size:13px;white-space:nowrap">Corp.</span></font></a>
</td>
</tr>
</tbody></table>
<br>
<div link="#0563C1" vlink="#954F72" lang="EN-US">
<div class="m_-4143234008412772602WordSection1">
<p class="MsoNormal">Hi,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">First time poster here. I have Suricata in-line running in af-packet mode using the binary packages in the apt repository, IP tables completely empty on Ubuntu 16.04, fully patched. It sits between my router and switch on an 802.1q trunk.
All services work fine for wired clients on all 4 VLANs. Radius logons work to my cisco catalyst switch (UDP 1645 auth/1646 accounting), but my Meraki WAP’s radius fails (UDP 1812-auth). If I disable Suricata and flip my inline pair to a bridge it works
just fine. I considered that maybe it was just 1812 and switched the Meraki’s to use 1645, same behavior. If I capture packets from the IPS, from the perimeter router, from the core firewall, and from the RADIUS server itself it looks the same:<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Access-Request WAP->Radius Server<u></u><u></u></p>
<p class="MsoNormal">Access-Challenge Radius Server->WAP<u></u><u></u></p>
<p class="MsoNormal">Access-Request WAP->Radius Server<u></u><u></u></p>
<p class="MsoNormal">Access-Challenge Radius Server->WAP (fragmented and re-assembled)<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">What’s weird is I see nothing in fast.log or drop.log referencing my AP’s IP, nor my Radius server so one would think that means it’s not acting on it, but the problem goes away when it’s bypassed.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I can included sanitized config snippets if that’s helpful?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">On my inline pair I’m disabling the following features on each nic, 0 being the “outside” 1 being the “inside”.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"># ETH0<u></u><u></u></p>
<p class="MsoNormal">auto enp0s20f0<u></u><u></u></p>
<p class="MsoNormal"> iface enp0s20f0 inet manual<u></u><u></u></p>
<p class="MsoNormal"> up ifconfig $IFACE 0.0.0.0 up<u></u><u></u></p>
<p class="MsoNormal"> up ip link set $IFACE promisc on<u></u><u></u></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE tso off<u></u><u></u></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE gro off<u></u><u></u></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE lro off<u></u><u></u></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE gso off<u></u><u></u></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE rx off<u></u><u></u></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE tx off<u></u><u></u></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE sg off<u></u><u></u></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE rxvlan off<u></u><u></u></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE txvlan off<u></u><u></u></p>
<p class="MsoNormal"> down ip link set $IFACE promisc off<u></u><u></u></p>
<p class="MsoNormal"> down ifconfig $IFACE down<u></u><u></u></p>
<p class="MsoNormal"># ETH1<u></u><u></u></p>
<p class="MsoNormal">auto enp0s20f1<u></u><u></u></p>
<p class="MsoNormal"> iface enp0s20f1 inet manual<u></u><u></u></p>
<p class="MsoNormal"> up ifconfig $IFACE 0.0.0.0 up<u></u><u></u></p>
<p class="MsoNormal"> up ip link set $IFACE promisc on<u></u><u></u></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE tso off<u></u><u></u></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE gro off<u></u><u></u></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE lro off<u></u><u></u></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE gso off<u></u><u></u></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE rx off<u></u><u></u></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE tx off<u></u><u></u></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE sg off<u></u><u></u></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE rxvlan off<u></u><u></u></p>
<p class="MsoNormal"> post-up ethtool -K $IFACE txvlan off<u></u><u></u></p>
<p class="MsoNormal"> down ip link set $IFACE promisc off<u></u><u></u></p>
<p class="MsoNormal"> down ifconfig $IFACE down<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Any help or advice would be greatly appreciated,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Dylan <u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
<br>
<br>
<br>
------------------------------<wbr>------------------------------<wbr>-------------
<br>
<font face="arial" color="#000000" size="2">This message was secured by <strong><a href="http://www.zixcorp.com" target="_blank"><font color="#0038A8">Zix</font><font color="#6D5E51">Corp</font></a><sup>(R)</sup></strong>.</font>
<br>______________________________<wbr>_________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@<wbr>openinfosecfoundation.org</a><br>
Site: <a href="http://suricata-ids.org" rel="noreferrer" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" rel="noreferrer" target="_blank">http://suricata-ids.org/<wbr>support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer" target="_blank">https://lists.<wbr>openinfosecfoundation.org/<wbr>mailman/listinfo/oisf-users</a><br>
<br></blockquote></div><br></div>