Security Services
Intrusion Prevention Service
Cisco ISA500 Series Integrated Security Appliance Administrator Guide
218
7
-
To save the IPS logs to the remote syslog server if you have a remote
syslog server support, you need to enable the Log feature, specify the
Remote Log settings, and check the
Remote Log
boxes for the
IPS
(signature based)
and
IPS (reputation based)
log facilities.
For more information about how to configure the log settings and log
facilities, and how to view the logs, see
•
Email Alert Threshold:
Enter the value of the email alert threshold. When the
hit count is over the email alert threshold, an alert email is sent to the
specified email acount.
To send the IPS alert emails to the specified email accont, you first need to
enable the IPS Alert feature and configure the email account settings, see
Configuring the Email Alert Settings, page 316
.
STEP 4
Click
Save
to apply your settings.
Blocking the Instant Messaging and Peer-to-Peer
Applications
Use the IM & P2P blocking page to block Instant Message (IM) and Peer-to-Peer
(P2P) traffic on the security appliance.
STEP 1
Click
Security Services -> IPS -> IM & P2P Blocking
.
The IM & P2P Blocking window opens. The supported IM applications are listed in
the IM Blocking table. The supported P2P applications are listed in the P2P
Blocking table.
STEP 2
Enter the following information:
•
IM & P2P Blocking Enable:
If you enable IPS, click
On
to enable the IM and
P2P Blocking settings.
•
View IM Blocking Item:
Allows you to view the signatures under a specific
IM application.
For example, if you choose MSN, only the signatures under the MSN
application are displayed. To display all signatures, choose
All
.
•
View P2P Blocking Item:
Allows you to view the signatures under a specific
P2P application.
