This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPS seems aggressive

I'm new to Sophos UTM, so I'm kind of working my way through the different modules and services. I have to say, I'm really loving this UTM.

Are the default settings for the IPS pretty aggressive? From what I have been seeing the past few days, the majority of the packets dropped by the IPS are from legit sites being accessed by my clients. For example, I have several Alarm.com IP cams and the IPS is blocking the Alarm.com connection to the cams.

Also, web browsing seems quite a bit slower with the IPS on.

Just curious what others have experienced with IPS.

Thanks,

Greg

This thread was automatically locked due to age.

0 FrankBarmentlo over 11 years ago

I found out if you select the "additional rules" it even logs Teamviewer, Skype login attempts, bittorrent traffic, and such things. Kind of unnecessary(I am a home user), but for companies it might come in useful.

You can tweak it and disable the rules that are causing problems, under the "advanced"-tab. you need the "SID", which you can find in both the log and live log.
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 11 years ago

Hi,

Yes, the IPS rules are aggressive.
See https://community.sophos.com/products/unified-threat-management/astaroorg/f/54/t/41225
for a list of rules with common false positives.

The IPS uses a lot of CPU, which can slow down your connection. Tuning the IPS settings for your environment helps, and 9.2x is supposed to be faster.
Make sure you only have your LAN/DMZ networks in the Protected Networks setting in the IPS.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 rrosson over 11 years ago in reply to BarryG

Hi,

Make sure you only have your LAN/DMZ networks in the Protected Networks setting in the IPS.

Barry

Are you suggesting that your public IP's should not be part of the protected networks for IPS. Just want to make sure. [:)]
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 11 years ago

Correct, no WAN or Internet IPs should be in that setting.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 rrosson over 11 years ago

Thanks Barry, Change completed. [:)]
Cancel
Vote Up 0 Vote Down

Cancel
0 gzartman over 11 years ago

Thanks guys. This is very helpful.

I will start playing around with the IPS and see which settings work best for me. In the short term, I think I'll shut it down until I can get my hands around the best settings.

Greg
Cancel
Vote Up 0 Vote Down

Cancel