Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 4 replies
  • Answers 2 answers
  • Subscribers 26 subscribers
  • Views 5871 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

can someone share the default lantowan_general signature filter criteria?

CyberA

I inadvertently changed my lantowan_general IPS policy and want to revert it back to the default.

I looked at an earlier Entities.xml export I had but it shows the same settigns as the lantowan_strict policy which seems odd.

    <Name>lantowan_general</Name>
    <Description>A General policy for LAN to WAN Traffic</Description>
    <RuleList>
      <Rule>
        <RuleName>Migrate_def_filter_2</RuleName>
        <SignaturSelectionType>All Application</SignaturSelectionType>
        <CategoryList>
          <Category>All Categories</Category>
        </CategoryList>
        <SeverityList>
          <Severity>All Severity</Severity>
        </SeverityList>
        <TargetList>
          <Target>All Target</Target>
        </TargetList>
        <PlatformList>
          <Platform>All Platform</Platform>
        </PlatformList>
        <RuleType>Default Signature</RuleType>
        <Action>Recommended</Action>
      </Rule>
    </RuleList>
  </IPSPolicy>

Can someone share the default signature filter criteria for lantowan_general?



This thread was automatically locked due to age.
Parents
  • 0

    CyberA,

    IPS default rules cannot be changed or removed at all. In fact the option inside the LAN to WAN (for example) are all greyed-out.

    See the screenshot:

    If you have a backup, revert the configuration back and you will get it back!

    Thanks

  • 0 in reply to lferrara

    Thanks Luk.

    I do have the read-only (greyed-out) policies but the one I screwed up was another (out-of-box policy?) which was configurable called lantowan_general. The docs are pretty loose on them: http://docs.sophos.com/nsg/sophos-firewall/v15010/Help/en-us/webhelp/onlinehelp/index.html#page/onlinehelp%2FIPSPolicyEdit.html%23

    I do have a backup before v16 upgrade but I'm afraid to restore it for many changes have occurred since then.

    Though .. now I'm fighting with various client issues because IPS is dropping recommended signatures (due my change) :(

    If only I could figure out what the default was, I can restore it and end my Friday blunder ...

  • 0 in reply to CyberA

    CyberA,

    from the online guide:

    The device provides following pre-defined policies. You can directly use policies 1 to 6 without any modifications while policies 7 to 10 can either be used directly or, can be modified as per your requirements:
    1. DMZ TO LAN
    2. DMZ TO WAN
    3. LAN TO DMZ
    4. LAN TO WAN
    5. WAN TO DMZ
    6. WAN TO LAN
    7. generalpolicy
    8. lantowan strict policy
    9. lantowan general policy
    10. dmzpolicy
     
    I do not have the rest of the policies (7 to 10). Also, if you have edit the 9 in this case, only you have the required modification. You have 2 ways to adjust the current situation:
    • use the logs to understand which IPS ID is dropping your good traffic and adjust the IPS policy (do not delete it this time :-)
    • rollback to a previous backup

    It is recommended to always backup the configuration before any big changes are made.

  • 0 in reply to lferrara

    Luk,

    Appreciate the tips, will be setting up a daily backup to a local FTP server.

    FWIW, modifying the IPS is what got me into this mess as I changed a single signature default action under the 'Migrate_def_filter_2' rule which lives under the 'lantowan_general' policy. This ended up overwriting and deleting all of the earlier signatures from the default set for that rule.

    The key take-away is:

    • Backup first to have a fail-safe
    • Don't modify an existing rule for a single signature as it will overwrite the entire set
    • After creating the new ALLOW rule move it to the top of the policy list

    Still interested in what the default category, severity, target, platform was for this 'Migrate_def_filter_2' rule if someone who has and can share it, would be much appreciated. Thanks.

    CyberA

Reply
  • 0 in reply to lferrara

    Luk,

    Appreciate the tips, will be setting up a daily backup to a local FTP server.

    FWIW, modifying the IPS is what got me into this mess as I changed a single signature default action under the 'Migrate_def_filter_2' rule which lives under the 'lantowan_general' policy. This ended up overwriting and deleting all of the earlier signatures from the default set for that rule.

    The key take-away is:

    • Backup first to have a fail-safe
    • Don't modify an existing rule for a single signature as it will overwrite the entire set
    • After creating the new ALLOW rule move it to the top of the policy list

    Still interested in what the default category, severity, target, platform was for this 'Migrate_def_filter_2' rule if someone who has and can share it, would be much appreciated. Thanks.

    CyberA

Children
No Data