Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 332 / 861

331 Preventing attacks
Blocking suspicious or malicious traffic with IDS
■
To enable logging of all events for a service level, check the service level name.
For example, to log all critical TCP events, expand the Critical folder, and then check TCP.
■
To enable logging of individual intrusion events, check the intrusion event name.
For example, to log the critical TCP event Sircam Worm Propagation, expand the Critical
folder and the TCP folder, and then check Sircam Worm Propagation.
5 Optionally, do one of the following:
■
To save your configuration now and activate later, on the toolbar, click Save .
■
To activate your configuration now, on the toolbar, click Activate .
When prompted to save your changes, click Yes .
To modify event settings from the properties dialog box
1 In the SGMI, in the left pane, under Policy click IDS/IPS .
2 In the right pane, on the Configuration tab, next to View, click Tree .
3
In the Policy name drop-down list, select an IDS/IPS policy.
4 To the left of a severity level, click the arrow to expand down to the IDS/IPS service level.
5 To the left of the IDS/IPS service, click the arrow to expand down to the individual intrusion
events.
6 Right-click the intrusion event you want to modify.
7 In the IDS Event Type Properties dialog box, do one of the following:
■
To enable logging and traffic blocking of this event, check Log this event and Block traffic if
this event is detected .
■
To enable only logging of this event, check Log this event .
■
To disable event logging and traffic blocking, uncheck Log this event and Block traffic if this
event is detected .
8 Click OK .
9 Optionally, do one of the following:
■
To save your configuration now and activate later, on the toolbar, click Save .
■
To activate your configuration now, on the toolbar, click Activate .
When prompted to save your changes, click Yes .
Related information
For further information related to this topic, see the following:
■
“IDS Event Type Properties dialog box—General tab” on page 643
■
“Monitoring IDS/IPS alerts” on page 482
Managing portmap settings
IDS/IPS services listen on specific ports for incoming traffic. The port number identifies the type of
port and what it is used for. For example, HTTP traffic uses port 80. The services define the type of
traffic that each port receives. For example, a File Transfer Protocol (FTP) service receives FTP traffic.
Traffic comes through the port in the form of protocols, which contain address information that
enables traffic to be routed properly.
To enable proper routing of incoming traffic by IDS/IPS services, you must select the protocols that
you want to associate with the IDS/IPS service. This enables the IDS/IPS service to listen for incoming
traffic on the port that is assigned to the protocol.