When I posted this for the previous beta version, the powers-that-be didn't seem terribly interested, but here it goes again.
It is not the least bit helpful or informative having :
IPS: Top blocked attacksTotal attacks blocked: 63 Rule IDPackets% of total19000724 38.09%29000823 36.5%39000610 15.87%406 9.52%
on the Network Security dashboard when I have no way of finding out what these rules are. I went to the snort rules search page, http://www.snort.org/pub-bin/sigs-search.cgi?cve=90008 , and none of these ID's are listed. Additionally, the IPS was blocking "attacks" while IPS was disabled, which it should not be doing. On should = On and Off = Off.
Please allow the packet filter to be disabled as in version 6. Admins need options to make Astaro work well for their unique environment. This flexability is especially useful when ASL is not being used as a perimeter device, but instead to separate and monitor within a LAN. On this 6.819 test box, where the only rule I've set for the packet filter is to pass anyanyany, it has mysteriously dropped 47k packets in a few minutes. This is "safe" data being passed internally that has already been checked and scanned by production filters. Now if this were actual live data that this was happening to, I'd want to turn off the packet filter until I figured out what data was being dropped. Currently, the only option to not lose data and minimize downtime would be to pull the astaro box out.
