This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Intrusion Protection Notification Rules - Need help

Our company is new to the Astaro security gateway.  I have been placed in charge of managing much of the security settings myself, but I am still having a hard time figuring out what settings to use for intrusion protection.

I apoligize, these are very basic questions, but I can't seem to find real answers so here goes.

*************************

On the Intrusion Protection Rules page I see three un-names colums (why not names the columns.  Is that really too much to ask as a feature of a premiere network product?  Here they are:

Column 1: green - red light
What do they mean?  Does the first box mean notification and the second mean permission? Please help?!?!

Column 2: Permissions (?)

Column 3: Details folder

Our office uses Skype.  I get hundreds of notifications on P2P policy violations.  I want to allow the Skype traffic but not trigger any notifications.  What does the first colum need to be set to and what does the 2nd column need to be?

We also want to block all chat/IM software and not be notified.  What should the setting be for this?

As an inexperienced network manager I am very frustrated with the lack of labels on the GUI.  I would expect the colums to have headings and settings to be identitfied if I mouse-over to tell me what the setting means.

Help anyone?

This thread was automatically locked due to age.

Parents

0 RufusToofus over 18 years ago

Our company is new to the Astaro security gateway.  I have been placed in charge of managing much of the security settings myself, but I am still having a hard time figuring out what settings to use for intrusion protection.

I apoligize, these are very basic questions, but I can't seem to find real answers so here goes.

*************************

On the Intrusion Protection Rules page I see three un-names colums (why not names the columns.  Is that really too much to ask as a feature of a premiere network product?  Here they are:

Column 1: green - red light
What do they mean?  Does the first box mean notification and the second mean permission? Please help?!?!

Column 2: Permissions (?)

Column 3: Details folder

Our office uses Skype.  I get hundreds of notifications on P2P policy violations.  I want to allow the Skype traffic but not trigger any notifications.  What does the first colum need to be set to and what does the 2nd column need to be?

We also want to block all chat/IM software and not be notified.  What should the setting be for this?

As an inexperienced network manager I am very frustrated with the lack of labels on the GUI.  I would expect the colums to have headings and settings to be identitfied if I mouse-over to tell me what the setting means.

Help anyone?

Which Version are you running ??
Make sure you have your INTERNAL NETWORK listed in the IPS/IDS to prevent the INTERNAL LAN being checked ....
Cancel
Vote Up 0 Vote Down

Cancel
0 mattr2 over 18 years ago in reply to RufusToofus

Thanks for the reply.

The version is:

ASG220
Release 6.303

If there is another place where I can actually pull a software buiild, please let me know.

I am really just asking what the three columns means on the intrusion protection rules page and what each setting means in those columns.

Thanks.
Cancel
Vote Up 0 Vote Down

Cancel
0 BrucekConvergent over 18 years ago in reply to mattr2

With the stability that Version 7.003 has brought to the table, I'd look seriously at upgrading to that... the IPS rule management is much, much simpler.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Cancel
0 RufusToofus over 18 years ago in reply to mattr2

Version 7 is way easier to look after / manage.
You need subscriptions for SMTP and HTTP proxy if you do not already have them, assuming you use HTTP and SMTP proxy.
There are a "few minor" bits missing in 7 such as EMAIL blacklisting ! but the IPS/IDS is easier and there are "check boxes to control P2P, IM and SKYPE ! EASY ! if you need V7 it is a "start again" scenario, you can "FLASH" your unit to V7 by downloading the correct ISO for appliances here ftp://sai7:rhasDoal9@ftp.astaro.de/ THIS is for APPLIANCES (i.e ASG220) ONLY.

YOU CANNOT RESTORE A V6 BACKUP to 7 so you would need to reconfigure the appliance from SCRATCH, however "follow the install WIZARD this will get you going (30 days free trial on licence) and your V6 licence IS compatible.
Cancel
Vote Up 0 Vote Down

Cancel
0 mattr2 over 18 years ago in reply to RufusToofus

We have only had the appliance for about 2.5 months.

It is good to know some of the management tools have already been updated.

When did the new version get released?
Cancel
Vote Up 0 Vote Down

Cancel
0 BrucekConvergent over 18 years ago in reply to mattr2

January 23rd, 2007. A little early, actually (7.003 fixes a lot of the outstanding stuff that was broken early on) ... I was told by someone that 7.003 was supposed to be the version that would allow import of a Version 6.x backup, but I don't think it made it into this release... probably look for it in 7.004...

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 BrucekConvergent over 18 years ago in reply to mattr2

January 23rd, 2007. A little early, actually (7.003 fixes a lot of the outstanding stuff that was broken early on) ... I was told by someone that 7.003 was supposed to be the version that would allow import of a Version 6.x backup, but I don't think it made it into this release... probably look for it in 7.004...

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 mattr2 over 18 years ago in reply to BrucekConvergent

Thanks for the notes on the version update. For some reason, the consulting company we use does not recommend teh upgrade. I am not sure why.

I am getting notified of a potential sercurity risk about 10 times a day.

Subject: [WARN-854] Anomaly Intrusion Protection Alert

Message........: Source used odd dest port: local source, syn: 0.9272
Time...........: 2007:04:27-07:09:07
Packet dropped.: no
IP protocol....: 6 (TCP)

We have about 20 employees on the web and I think this is a notification about an internal IP hitting dead pages on the outside web. Does that sound correct? I tried to disable to notification, but can't really locate the place to do it.

Can anyone help?
Cancel
Vote Up 0 Vote Down

Cancel
0 RufusToofus over 18 years ago in reply to mattr2

Thanks for the notes on the version update. For some reason, the consulting company we use does not recommend teh upgrade. I am not sure why.

I am getting notified of a potential sercurity risk about 10 times a day.

Subject: [WARN-854] Anomaly Intrusion Protection Alert

Message........: Source used odd dest port: local source, syn: 0.9272
Time...........: 2007:04:27-07:09:07
Packet dropped.: no
IP protocol....: 6 (TCP)

We have about 20 employees on the web and I think this is a notification about an internal IP hitting dead pages on the outside web. Does that sound correct? I tried to disable to notification, but can't really locate the place to do it.

Can anyone help?

The usual cause is you do not have the LOCAL Network(s) in the "GLOBAL IPS Settings"
V7 >Network Security >Intrusion Protection >Global IPS Settings
+ INTERNAL (Network) Policy Drop Silently

V6 - Intrusion Detection > Settings > Local Networks
+ Internal (Network)

Upgrade from what to what ?? V6 -V7 or 7.002 to 7.003 ??
Cancel
Vote Up 0 Vote Down

Cancel
0 BrucekConvergent over 18 years ago in reply to RufusToofus

We haven't been (my company) recommending anyone update either, until now.. only thing we're waiting on now is configuration conversion for a V6 to V7 upgrade (our customers have pretty complex configurations).

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Cancel
0 mattr2 over 18 years ago in reply to BrucekConvergent

Thanks Roofus & Bruce,

Our ASG220 appliance is running Version Release 6.303

The notifications are still coming through, but I am not sure if notifications are needed. They seem to be benign (from what I can tell.) If that is the case, I want to disable the notifications from clogging up my inbox.

I want back and looked at the "Global Settings" and the only item selected is "Internal (Network)." I do see another option for "Network-Internal". I am not quite sure of the difference between the two.
Cancel
Vote Up 0 Vote Down

Cancel
0 RufusToofus over 18 years ago in reply to mattr2

Hmmm do you have a second INTERNAL Network Range defined ?
Basically any LOCAL Network on the "inside" should be listed so for example if you are running two split networks say on different interfaces, both wouyld need to be included ....
Cancel
Vote Up 0 Vote Down

Cancel