Symantec 10521148 - Network Security 7161, Implementation Manual

Page: 131 / 214

123 Configuring detection and response
Creating and applying protection policies
5 In Event Properties , in Logging Options , to enable logging for the selected
events, check Log Event .
6
Do one of the following:
■
To log events for any source or destination, click Log For All IPs .
■
To log events for some addresses, click Log For Selected IP Ranges .
■
To prevent logging for certain addresses, click Log All Except IP
Ranges .
7 In IP Ranges , if you chose to limit logging, in Source : IP address , enter the
source address.
8
In Source: Mask , enter the netmask in CIDR format.
9 In Source: Port , enter the port number.
10 In Destination : IP address , enter the destination address.
11 In Destination: Mask , enter the netmask in CIDR format.
12 In Destination: Port , enter the port number.
13 In IP Range List , you can enter a range of IP addresses rather than entering
them one at a time in Source and Destination .
14 Do one of the following:
■
Click Add to add these IP addresses to your logging criteria.
■
Click Delete to remove these IP addresses from your logging criteria.
15 In Logging Options , check For Every Non-Logged Events Log One Event ,
and enter a number.
16 In Block Event , check Block Event to enable blocking of the designated
events.
Blocking applies only to in-line pairs.
Blocking is enabled/disabled on a per event basis, but is not tunable by IP
address.
17 Click OK .
Deleting custom protection policies
You can delete protection policies that you created, but not predefined
protection policies.
To delete a protection policy
1 On the Policies > Protection Policies tab, click a user-defined protection
policy.