Overview:

A security vulnerability is an unintended flaw that allows malicious users to surreptitiously attack a network. Attackers can exploit such vulnerabilities to break into and damage the network by changing, destroying, or stealing secured or confidential information, or by installing malware.

To protect a network against security vulnerabilities, the Versa Operating System (VOS) unified threat management (UTM) capabilities include intrusion detection and prevention (IDP). IDP is a preemptive approach to network security that identifies potential threats and responds to them based on user-defined policy.

Security analysts can use IDS enabled VOS to examine network traffic and the network protocols, applications, and operating systems running on the network. To inspect and process the desired traffic, Versa device can be placed inline. However, commonly its placed at the perimeter of a corporate network.

Implementing a properly tuned and managed IPS solution at all corporate ingress and egress points helps to ensure that new and previously identified threats are dropped at the perimeter, while allowing legitimate traffic to pass.

Having an IPS deployment at the edges of the network provides the preventative measures and control needed to combat new and existing threats, and including an IDS inside the firewall and at critical internal network nodes provides visibility into internal activity.

Fundamentals:

IDP comprises two components:

• Intrusion detection system (IDS) is the process of examining the network for indications of vulnerabilities and for detecting inappropriate or anomalous activity.
• Intrusion prevention system (IPS) is the process of stopping vulnerabilities by responding to inappropriate or anomalous activity. Responses can include dropping data packets and disconnecting connections that are transmitting unauthorized data.

IPS performs the following types of vulnerability detection to help prevent attacks, including zero-day attacks such as worms or viruses:

• Signature-based detection—Signatures are a set of rules that a vulnerability profile uses to detect intrusive activities. With signature-based detection, a security profile compares a software or application pattern with a database of signatures, identifying malicious activity by matching patterns to those in the database. Versa security packs (SPacks) provide a set of predefined signatures, and you can also create custom signatures.
• Anomaly detection—Anomaly detection monitors a network for unusual events or trends. You configure the vulnerability profile that compares an observed event with the baseline of the normal traffic. Anomaly detection detects patterns that are normally not present in the traffic, so it is useful for detecting new attacks.

 

 

Configuration:

1. Configure IDS and IPS vulnerability profiles. Recommendation is to use the predefined vulnerability profiles. We can create custom vulnerability profiles.
2. Then associate the vulnerability profiles with a next-generation firewall (NGFW) security profile (also called an access policy profile) in an NGFW policy.
3. In the policy you define the traffic to match based on various parameters, such as zones and applications, and you configure the policy to enforce the action defined in vulnerability profile.

Prerequisites:

• NGFW service is enabled on the Versa device
• SPACK premium is installed (to have IDP signature database)

1. Vulnerability Profiles:
    
   1. Predefined:

 

admin@CPE01-cli> show orgs org-services Alpha security profiles ips signature
                            SIGNATURE        REFERENCE  REFERENCE
NAME                        ID         NAME  TYPE       ID
-------------------------------------------------------------------
All Anomaly Rules
All Attack Rules
Client Protection
Database Profile
ICS Profile
IOT Profile
Lateral Movement Detection
Linux OS Profile
MAC OS Profile
Malware Profile
Mobile Client Protection
Server Protection
Versa Branch Profile
Versa Data Center Profile
Versa Enterprise Profile
Versa Recommended Profile
Windows OS Profile

 

b. Custom:

Custom vulnerability profiles can be configured to have the flexibility of which attack signatures are being inspected and what actions they need to invoke based on the network's requirement. It allows for various configuration customization from CVE year, signature set, OS type, to application, attack severity as well as custom actions.

admin@CPE01-cli> show configuration orgs org-services Alpha security profiles ips 2025_Vulnerability_Profile
rules {
    2025_Rule1 {
        packet-capture {
            pre-window  1;
            post-window 1;
            enable      false;
        }
        state         enabled;
        action {
            predefined drop-session;
        }
        cve-year      [ 2025 ];
        signature-set [ all ];
    }
}
lef-profile Default-Logging-Profile;

 

2. NGFW Policy:

The NGFW policy is configured to permit/deny the specific IP/port/application/zone/routing-instance based traffic. For a policy that permits the traffic, it can be associated with IPS profile, for invoking the IDP engine inspection. Only the traffic that matches such policy, is subjected to the configured IPS profile.

admin@CPE01-cli> show configuration orgs org-services Alpha security access-policies Default-Policy rules Allow_From_Trust
rule-disable false;
match {
    source {
        zone {
            zone-list [ Intf-LAN-Zone W-ST-Alpha-LAN-VR-Internet ];
        }
        user {
            user-type any;
        }
    }
}
set {
    security-profile {
        ips {
            user-defined-ips-profile 2025_Vulnerability_Profile;
        }
    }
    action                allow;
    tcp-session-keepalive disabled;
    lef {
        profile-default true;
        event           both;
        options {
            send-pcap-data {
                enable false;
            }
        }
    }
}

 

3. Predefined override vulnerability profile:

There may be requirements to override the existing predefined vulnerability profiles for certain attach signatures or in case of false positives for certain threats. In such case, one can continue to use the complete benefits of a predefined vulnerability profile in addition to certain exceptions. For eg, if the threat id is being falsely identified for a legitimate pdf attachment causing emails to be blocked, we configure the following override profile:

 

Validation:

 

- SPACK premium is installed on the device:

admin@CPE01-cli> show security security-package information
Version             2364
API Version         11
Flavor              premium
Release Date        2026-08-10
Update Type         full

- Security access policy has the IPS vulnerability profile called:

admin@CPE01-cli> show configuration orgs org-services Alpha security access-policies Default-Policy rules Allow_From_Trust | display set
set orgs org-services Alpha security access-policies Default-Policy rules Allow_From_Trust rule-disable false
set orgs org-services Alpha security access-policies Default-Policy rules Allow_From_Trust match source zone zone-list [ Intf-LAN-Zone W-ST-Alpha-LAN-VR-Internet ]
set orgs org-services Alpha security access-policies Default-Policy rules Allow_From_Trust match source user user-type any
set orgs org-services Alpha security access-policies Default-Policy rules Allow_From_Trust set security-profile ips predefined-ips-profile "Versa Recommended Profile"
set orgs org-services Alpha security access-policies Default-Policy rules Allow_From_Trust set action allow
set orgs org-services Alpha security access-policies Default-Policy rules Allow_From_Trust set tcp-session-keepalive disabled
set orgs org-services Alpha security access-policies Default-Policy rules Allow_From_Trust set lef profile-default true
set orgs org-services Alpha security access-policies Default-Policy rules Allow_From_Trust set lef event both
set orgs org-services Alpha security access-policies Default-Policy rules Allow_From_Trust set lef options send-pcap-data enable false

- Security database compile status is showing Ready:

admin@CPE01-cli> show security ips compile-status
                   IGNORE                LOAD       IGNORE     FAIL
BRIEF   LOAD IPS   IPS        FAIL IPS   APPID      APPID      APPID      COMPILE
STATUS  SIGNATURE  SIGNATURE  SIGNATURE  SIGNATURE  SIGNATURE  SIGNATURE  TIME
------------------------------------------------------------------------------------
Ready   13468      29428      0          0          181        0          00:00:45

- User in the LAN tried to download a potential malware, which was blocked:

Troubleshooting:

 

1. Check the session extensive output from the Versa/event log from Analytics to validate the security policy name:

sessions extensive 0 2 192216
 source-ip                  172.20.2.10
 destination-ip             151.101.66.49
 source-port                35486
 destination-port           443
 protocol                   6
 natted                     Yes
 sdwan                      No
 application                http2/(predef)
 forward-pkt-count          451
 forward-byte-count         26132
 reverse-pkt-count          2814
 reverse-byte-count         4171139
 dropped-forward-pkt-count  0
 dropped-forward-byte-count 0
 dropped-reverse-pkt-count  0
 dropped-reverse-byte-count 0
 session-age                00:01:30
 idle-for                   00:00:27
 idle-timeout               240
 pbf-enabled                true
 forward-egress-vrf         Internet-Transport-VR
 reverse-egress-vrf         Alpha-LAN-VR
 session-provider-zone      0
 forward-offload            false
 reverse-offload            false
 forward-ingress-interface  vni-0/1.0
 forward-egress-interface   vni-0/0.0
 reverse-ingress-interface  vni-0/0.0
 reverse-egress-interface   vni-0/1.0
 forward-fc                 fc_be
 reverse-fc                 fc_be
 forward-plp                low
 reverse-plp                low
 external-service-chaining  false
 is-child                   No
 parent-sess-id             0
 device                     ""
 source-sgt                 0
 destination-sgt            0
 nat-source-ip              11.11.11.101
 nat-destination-ip         151.101.66.49
 nat-source-port            22804
 nat-destination-port       443
 nat-rule-name              DIA-Rule-Alpha-LAN-VR-Internet
 nat-direction              C2S
 rx-wan-ckt                 vni-0/1.0
 tx-wan-ckt                 vni-0/1.0
 tx-branch                  -
 forward-ingress-ckt        vni-0/1.0
 forward-egress-ckt         Internet
 reverse-ingress-ckt        Internet
 reverse-egress-ckt         vni-0/1.0
 forward-sdwan-rule-name    Any
 access-policy              Allow_From_Trust

2. Check threat signature is part of vulnerability profile called in the security policy:

admin@CPE01-cli> show orgs org-services Alpha security profiles ips signature predefined-profile "Versa Recommended Profile" | match PDF
  name           "FILE-PDF Adobe Acrobat Pro U3D IFF out of bounds read attempt"
  name           "Acrobat Reader PDF CVE-2021-28640 Use After Free"
  name           "TIQ-SEP-2013: Aloaha PDF Suite CVE-2013-4978 Stack Based Buffer Overflow Attempt"
  name           "Foxit PDF SDK ActiveX SetLogFile Buffer Overflow"
  name           "Mozilla Firefox Built-in PDF Viewer Same Origin Policy Bypass"
  name           "CoolPDF Reader Image Stream Processing Buffer Overflow"
  name           "CoolPDF Reader Image Stream Processing Buffer Overflow"
  name           "Microsoft Windows PDF Library CVE-2016-0117 Code Execution"
  name           "Microsoft Windows PDF Library CVE-2016-3203 Code Execution"
  name           "Microsoft Windows PDF Library Heap-based Buffer Overflow"
  name           "Microsoft Windows PDF Library Heap-based Buffer Overflow"
  name           "CoolPDF Reader Image Stream Processing Buffer Overflow"
  name           "Foxit Reader PDF Parsing Shading Pattern Integer Overflow"
  name           "FILE-PDF Microsoft Speech API remote code execution attempt"
  name           "Foxit PDF Reader and Editor Annotation rect Use After Free"
  name           "Nitro Pro PDF ICCBased ColorSpace Stroke Color Heap-based Buffer Overflow"
  name           "Nitro Pro PDF Indexed ColorSpace Integer Overflow"
  name           "Nitro Pro PDF Object Stream Parsing Number of Objects Integer Overflow"
  name           "Foxit Reader and PhantomPDF Text Field fileSelect Use After Free"
  name           "Foxit Reader and PhantomPDF Field Format Event Use After Free"
  name           "Formidable PRO2PDF CVE-2023-28663 - Authenticated SQL Injection"
  name           "Foxit PDF Reader and Editor exportXFAData Handling Remote Code Execution"
  name           "Foxit PDF Reader and Editor XFA object exportXFAData Handling Remote Code Execution"
  name           "FILE-PDF Adobe Acrobat Reader graphics module crash attempt"
  name           "FILE-PDF Adobe Acrobat Reader raster image memory corruption attempt"

 

3. Check if the statistics are incrementing:

 

admin@CPE01-cli> show orgs org-services Alpha security ips statistics

PROTOCOL  ACTIVE  CREATED  DROPPED  CLOSED  IGNORED

-----------------------------------------------------

tcp       50      3530     0        3480    0

udp       4       6643     0        6639    0

icmp      0       12       0        12      0

other     0       0        0        0       0

 

 

admin@CPE01-cli> show orgs org-services Alpha security ips statistics

PROTOCOL  ACTIVE  CREATED  DROPPED  CLOSED  IGNORED

-----------------------------------------------------

tcp       13      3531     0        3518    0

udp       0       6643     0        6643    0

icmp      0       12       0        12      0

other     0       0        0        0       0

 

 

4. Set up idp debugs to investigate if this traffic is being identified as the threat correctly:

 

configure

set debug idp all-flags level all send to file name /var/log/versa/idp/fast.log
commit

70951 2026-09-03 10:46:21.019 DEBUG [0x102] idp_pkt_data_handler: IDP sess-hdl 0x7f3b8e141302, dir 1, src-ip 66.117.22.190, dest-ip 172.20.2.10, Protocol 6 len '91'
70952 2026-09-03 10:46:21.019 DEBUG [0x102] Detect: run detect
70953 2026-09-03 10:46:21.019 DEBUG [0x102] idp_pkt_data_handler: IDP sess-hdl 0x7f3b8e141302, dir 1, src-ip 0x427516be, dest-ip 0xac14020a, Protocol 6 action '2'
70954 2026-09-03 10:46:21.019 DEBUG [0x102] idp_nfp_cmn_pkt_handler: IDP------- shdl(139893763478274) packet action 2
70955 2026-09-03 10:46:21.019 DEBUG [0x102] vs_idp_process_result: received: metadata.buffered.s2c.stream(0.0)
70956 2026-09-03 10:46:21.019 DEBUG [0x102] vs_idp_process_result: ips_inspect_enabled: True
70957 2026-09-03 10:46:21.019 DEBUG [0x102] vs_idp_process_result: reach_inspect_limit: False
70958 2026-09-03 10:46:21.019 DEBUG [0x102] vs_idp_process_result: notify_stream: offset: 739 dir: 0, data: 0x7f3b917af0e3, data_len: 739
70959 2026-09-03 10:46:21.019 DEBUG [0x102] vs_idp_process_result: do_inspect: 0, detect_discard: 0 reach_inspect_limit: 0
70960 2026-09-03 10:46:21.019 DEBUG [0x102] idp_pvt_data_handler: VS_DATA_EVENT_STREAM event is received
70961 2026-09-03 10:46:21.019 DEBUG [0x102] idp_nfp_strm_handler: IDP------- shdl(139893763478274) strm action 2
70962 2026-09-03 10:46:21.019 DEBUG [0x102] idp_pvt_data_handler: VS_DATA_EVENT_PKT event is received
70963 2026-09-03 10:46:21.019 DEBUG [0x102] idp_pvt_data_handler: IDP sess-hdl 0x7f3b8e141302, dir 1, src-ip 66.117.22.190, dest-ip 172.20.2.10, Protocol 6 len '91'