This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Using UTM with 3rd party IDS

As an MSSP partner, we've sold a couple of SG310s to a customer, along with the IDS and SEIM we offer through another technology partner. Ideally, the IDS would jack into a span port. Is there a way to configure one of the unused interfaces on the SG to be a span port, so that all traffic is monitored by the IDS?

This thread was automatically locked due to age.

Parents

0 BAlfson over 10 years ago

Hi, Brian, and welcome to the User BB!

When you have a moment, please discuss the advantages of the IDS you sold as compared to the recently-improved Intrusion Prevention System in the UTM.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 briancarmen over 10 years ago in reply to BAlfson

Thanks for the welcome, Bob.

It's all about defense in depth, really. We have been extremely pleased with the Sophos products (we wouldn't have opted to partner with you otherwise), but every technology has its limits.

With the particular customer I'm deploying in right now, they have had recent incidents. Add to that the fact that their entire IT staff is new to the organization and has inherited a...cluster...the added visibility of a network IDS in conjunction with the IPS of the UTM was the way to go. We're deploying the IDS first, prior to replacing their existing SonicWalls with SG 310s, with the intention of using the data gathered to inform the UTM's rules, as well as to determine which of the stupid number of rules in the SonicWalls can be eliminated or tweaked.

SANS actually has a pretty good paper about the benefits of deploying both IDS and IPS together. http://www.sans.org/reading-room/whitepapers/detection/understanding-ips-ids-ips-ids-defense-in-depth-1381

I have submitted the feature request as Scott suggested. Thanks for the help guys!
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 briancarmen over 10 years ago in reply to BAlfson

Thanks for the welcome, Bob.

It's all about defense in depth, really. We have been extremely pleased with the Sophos products (we wouldn't have opted to partner with you otherwise), but every technology has its limits.

With the particular customer I'm deploying in right now, they have had recent incidents. Add to that the fact that their entire IT staff is new to the organization and has inherited a...cluster...the added visibility of a network IDS in conjunction with the IPS of the UTM was the way to go. We're deploying the IDS first, prior to replacing their existing SonicWalls with SG 310s, with the intention of using the data gathered to inform the UTM's rules, as well as to determine which of the stupid number of rules in the SonicWalls can be eliminated or tweaked.

SANS actually has a pretty good paper about the benefits of deploying both IDS and IPS together. http://www.sans.org/reading-room/whitepapers/detection/understanding-ips-ids-ips-ids-defense-in-depth-1381

I have submitted the feature request as Scott suggested. Thanks for the help guys!
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data

Using UTM with 3rd party IDS

Submitted a Tech Support Case lately from the Support Portal?