D-Link 800 - DFL 800 - Security Appliance, User Manual

Page: 272 / 469

After pattern matching recognizes an intrusion in traffic subject to an IDP Rule, the Action
associated with that Rule is taken. The administrator can associate one of three Action options with
an IDP Rule:
• Ignore - Do nothing if an intrusion is detected and allow the connection to stay open.
• Audit - Allow the connection to stay open but log the event.
• Protect - This option drops the connection and logs the event (with the additional option to
blacklist the source of the connection or switching on ZoneDefense as described below).
IDP Blacklisting
The Protect option includes the option that the particular host or network that triggers the IDP Rule
can be added to a Blacklist of offending traffic sources. This means that all subsequent traffic
coming from a blacklisted source with be automatically dropped by NetDefendOS. For more details
of how blacklisting functions see Section 6.7, “Blacklisting Hosts and Networks”.
IDP ZoneDefense
The Protect action includes the option that the particular D-Link switch that triggers the IDP Rule
can be de-activated through the D-Link ZoneDefense feature. For more details on how ZoneDefense
functions see Chapter 12, ZoneDefense.
6.5.8. SMTP Log Receiver for IDP Events
In order to receive notifications via email of IDP events, a SMTP Log receiver can be configured.
This email will contain a summary of IDP events that have occurred in a user-configurable period of
time.
When an IDP event occurrs, the NetDefendOS will wait for Hold Time seconds before sending the
notification email. However, the email will only be sent if the number of events occurred in this
period of time is equal to, or bigger than the Log Threshold. When this email has been sent,
NetDefendOS will wait for Minimum Repeat Time seconds before sending a new email.
The IP Address of SMTP Log Receivers is Required
When specifying an SMTP log receiver, the IP address of the receiver must be specified. A domain
name such as dns:smtp.domain.com cannot be used.
Example 6.20. Configuring an SMTP Log Receiver
In this example, an IDP Rule is configured with an SMTP Log Receiver. Once an IDP event occurs, the Rule is
triggered. At least one new event occurs within the Hold Time of 120 seconds, thus reaching the log threshold
level (at least 2 events have occurred). This results in an email being sent containing a summary of the IDP
events. Several more IDP events may occur after this, but to prevent flooding the mail server, NetDefendOS will
wait 600 seconds (equivalent to 10 minutes) before sending a new email. An SMTP server is assumed to have
been configured in the address book with the name smtp-server.
CLI
Adding an SMTP log receiver:
gw-world:/> add LogReceiver LogReceiverSMTP smt4IDP IPAddress=smtp-server
Receiver1=youremail@yourcompany.com
IDP Rules:
gw-world:/> cc IDPRule examplerule
6.5.8. SMTP Log Receiver for IDP
Events Chapter 6. Security Mechanisms
272