Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 322 / 861

321 Preventing attacks
Blocking suspicious or malicious traffic with IDS
each. For example, a High_Security policy indicates a high security level. Depending on the level of
security you require and the situation in which you need to apply the policy, you can choose from or
modify these pre-configured policies or create your own.
Determine the level of security you need and apply the most appropriate IDS/IPS policy to your
network resources.
The heuristic detection levels and the policies to which they correspond are shown in the following
table.
The following topics discuss the creation and use of IDS/IPS policies:
■
Creating IDS/IPS policies
■
Applying IDS/IPS policies
■
Modifying event log and block settings
Creating IDS/IPS policies
The security gateway includes four pre-configured IDS/IPS policies that correspond with each of the
four heuristic detection levels. These pre-configured policies can be used to immediately detect and
prevent malicious traffic, or they can be modified or used as a starting point for creating customized
policies.
Each IDS/IPS policy contains a name, heuristic level, caption, and optional descriptive text. You can
modify each of these values in a pre-configured policy to adapt the IDS/IPS policy to your
environment. When creating a new policy, you must provide a name, heuristic detection level, and a
brief caption. Both pre-configured and user-configured policies can be deleted.
LiveUpdate may add, delete, or modify signatures in an IDS/IPS policy. After performing a LiveUpdate,
an IDS/IPS policy may have new signatures, signatures removed, or different log and block settings.
Prerequisites
None.
To create an IDS/IPS policy
1
In the SGMI, in the left pane, under Policy, click IDS/IPS .
2 In the right pane, on the Policies tab, click New .
3
In the IDS/IPS Policy Properties dialog box, on the General tab, in the Name text field, type a name
for the new policy.
4 In the Heuristic drop-down list, select a detection level.
5 In the Caption text box, type a brief description of the policy.
6 Optionally, on the Description tab, type a more detailed description than you typed in the Caption
text box.
Table 9-1 Heuristic detection levels
Heuristic level IDS/IPS Policy Alert level logged Alert level blocked Recommended usage
Low Low_Security Error and above Critical and above Apply to relatively secure situations, such as
inside interfaces.
Medium Medium_Security Warning and above Alert and above Apply to moderately secure situations, such
as service networks.
High High_Security Notification and
above Error and above Apply to more exposed situations such as
outside interfaces.
Very High Very_High_Security All Warning and above Apply in the most exposed situations