Security Services
Intrusion Prevention Service
Cisco ISA500 Series Integrated Security Appliance Administrator Guide
215
7
This section includes the following topics:
•
General IPS Settings, page 215
•
Configuring the IPS Policy and Protocol Inspection, page 216
•
Blocking the Instant Messaging and Peer-to-Peer Applications,
page 218
General IPS Settings
Use the IPS Setup page to enable or disable the IPS service, choose the security
zones you want to protect, update the IPS signatures, and view the IPS signature
status and logs.
STEP 1
Click
Security Services -> IPS -> IPS Setup
.
The IPS Setup window opens.
STEP 2
Click
On
to enable IPS, or Click
Off
to disable IPS.
STEP 3
Specify the zones to block the intrusion for incoming traffic from the selected
zones:
•
WAN zone:
Choose this option to block the intrusion for incoming traffic from
the WAN zone. This is the default setting.
•
WAN + VPN zone:
Choose this option to block the intrusion for incoming
traffic from both WAN and VPN zones.
•
All zones:
Choose this option to block the intrusion for the incoming traffic
from all zones.
STEP 4
In the
IPS Status
area, you can perform the following tasks:
•
IPS Signatures:
Displays the status of IPS signature file, including the
expiration date of the security license, the name of the signature file, and the
date and time of your last signature update.
•
View IPS Logs:
IPS logs a message if an attack is detected. Click this button
to view all IPS log messages.
•
Email Alert Setting:
IPS sends an alert message to the specified email
account if an attack hits the email alert threshold. Click this link to see the
email alert settings for IPS Alert events.
