Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Руководство администратора

Страница: 333 / 861

332 Preventing attacks
Blocking suspicious or malicious traffic with IDS
For example, you decide to apply an IDS/IPS service to listen for incoming traffic on port 80. Since port
80 is used for HTTP traffic, you enable the HTTP service that includes the http protocol. You receive
incoming traffic on port 80 in the form of http protocols.
You can enable IDS/IPS services and associate protocols with these services so that intrusion events
can be triggered. Pre-defined IDS/IPS services are delivered with the security gateway. You can remove
or reapply pre-defined services, but you cannot add new services.
Commonly used protocols are delivered with the security gateway. You can also create your own
protocols. You must add protocols that you create to IDS/IPS services before intrusions can be
identified in any incoming traffic on these protocols.
Note: Signatures for HTTPS are handled by the HTTP IDS/IPS service that is listed in the portmap
table.
You can configure HTTP to enable HTTPS ports by adding HTTPS ports to the HTTP proxy, or by
configuring the HTTP protocol in a service group.
See
“Configuring the HTTP proxy to listen on additional ports for secure connections” on page 214.
See “Customizing the HTTP protocol to pass HTTPS traffic” on page 187.
Prerequisites
None.
To manage portmap settings
1
In the SGMI, in the left pane, under Policy, click IDS/IPS .
2 In the right pane, on the Portmap tab, select the entry that you want to configure, and then click
Properties .
3 In the IDS Portmap Configuration Properties dialog box, on the General tab, do the following:
■
Check Enable .
■
In the Caption text box, type a brief description of the IDS/IPS service.
4 To move protocols from one list to the other, on the Protocols tab, select a protocol, and then click
the right-arrow
>> button or the left-arrow << button.
5 Optionally, on the Description tab, type a more detailed description than you typed in the Caption
text box.
6 Click OK .
7
Optionally, do one of the following:
■
To save your configuration now and activate later, on the toolbar, click Save .
■
To activate your configuration now, on the toolbar, click Activate .
When prompted to save your changes, click Yes .
Related information
For further information related to this topic, see the following:
■
“IDS Portmap Configuration Properties dialog box—General tab” on page 645
■
“IDS Portmap Configuration Properties dialog box—Protocols tab” on page 645
■
“Understanding how protocols affect traffic” on page 168
■
“Enabling a new protocol to trigger IDS/IPS events” on page 182