This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

5.001 IPS not working

tsol2001 over 21 years ago

I run a few test with retina, but the IPS is not working. No interception nor any counters go up.
I had this in an earlier version running.
I tried diffrent interface settings from no entry in protected networks, to all local networks. nothing.

This thread was automatically locked due to age.

Parents

0 Manctastic over 21 years ago

Have you got the updated liscence for it?

Added the host/network your trying to scan from to the excluded list?

All local networks should be in the box, but it seems that traffic will only show up in the IPS if there are rules allowing that trafific through the firewall, so traffic dropped by the packet filter will not show up in the IPS.
Cancel
Vote Up 0 Vote Down

Cancel
0 tsol2001 over 21 years ago in reply to Manctastic

i used the partner licence wich says ips on.

Opend all port to DMZ and run the scan on our linux webserver. Few problems where found, but no IPS counters went up.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 tsol2001 over 21 years ago in reply to Manctastic

i used the partner licence wich says ips on.

Opend all port to DMZ and run the scan on our linux webserver. Few problems where found, but no IPS counters went up.
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Stephan_Scholz over 21 years ago in reply to tsol2001

Do you have shell access to the firewall?

Can you check the following:

- Is the snort process running?
  ps x | grep snort

- Are there any netfilter rules in the ips table?
  iptables -t ips -L

- Are there any IPS rules written to the rule file?
  ls -l /var/sec/chroot-snort/etc/snort/rules/astaro.rules

Regards,
Stephan
Cancel
Vote Up 0 Vote Down

Cancel
0 tsol2001 over 21 years ago in reply to Stephan_Scholz

Seems to work with 5.003.
Nice
Cancel
Vote Up 0 Vote Down

Cancel