Symantec 10521146 - Network Security 7120, Administration Manual

Page: 157 / 392

157 Responding
Managing flow alert rules
2 In Flow Alert Rules , select an existing flow alert rule and click Delete .
3 Click OK to save and exit.
Providing an appropriate mask
Symantec Network Security checks the subnet mask, and sends an error
message if the mask is not appropriate for the number of bits specified in the
subnet address. For example, if a full 32-bit IP address is entered, then the mask
must also be 32. However, if you enter just the network portion of the IP address,
the number of bits in the mask should match the number of bits given in the
network portion of the IP address.
For example, an IP address entered as 172.27.101.0 must have, at least, a 24-bit
mask but an IP address entered as 172.27.101.1 would require a 32-bit mask.
Using the permit rule type
When selecting a Rule Type of Permit, apply a method similar to that used in
router access lists. The following example illustrates how to use multiple permit
rules in conjunction with an alert rule to target a specific network for triggering
alerts. In this example, Symantec Network Security allows only traffic with
source IP addresses from 192.168.0.1 through 192.168.0.3 to pass without
generating an alert. All traffic originating from 192.168.0.x generates an alert.
Note: Symantec Network Security examines these rules sequentially. After it
makes an IP address/port match, it executes the corresponding rule, without
examining or executing any further.
Source IP Address 192.168.0.1/32 Permit
Source IP Address 192.168.0.2/32 Permit
Source IP Address 192.168.0.3/32 Permit
Source IP Address 192.168.0.0/24 Alert