Intrusion Prevention FAQs - Revision history

Græmer: /* Can Intrusion Prevention rules be configured differently within different policies? */

2022-05-03T18:40:09Z

Can Intrusion Prevention rules be configured differently within different policies?

← Older revision		Revision as of 18:40, 3 May 2022
Line 15:		Line 15:
	=== Can Intrusion Prevention rules be configured differently within different policies? ===		=== Can Intrusion Prevention rules be configured differently within different policies? ===

	No. Intrusion Prevention applies to all traffic flowing through ~~Untangle~~ so different configurations are not possible.		No. Intrusion Prevention applies to all traffic flowing through NG Firewall so different configurations are not possible.

	=== What is the difference between rule block actions? ===		=== What is the difference between rule block actions? ===

Cblaise at 19:40, 15 May 2019

2019-05-15T19:40:38Z

← Older revision		Revision as of 19:40, 15 May 2019
Line 33:		Line 33:

	NOTE: Unlike other Rule actions, the Whitelist action doesn't enable logging/blocking for rules. Signatures affected by Whitelist rules will still be processed by the first matching non-Whitelist Rule.		NOTE: Unlike other Rule actions, the Whitelist action doesn't enable logging/blocking for rules. Signatures affected by Whitelist rules will still be processed by the first matching non-Whitelist Rule.

			=== How do I extend the HOME_NET variable? ===

			IPS attempts to determine the appropriate HOME_NET based on your network configuration but if a network doesn't appear to be in the list (mouse over the variable), you can either replace the HOME_NET variable value entirely or append to the existing using by leaving the default value and adding a comma separated list of additional CIDR formatted networks such as default,10.10.10.10/32,192.168.2.0/24.

Cblaise: /* How can I exclude network processing for signatures */

2019-05-15T19:38:13Z

How can I exclude network processing for signatures

← Older revision		Revision as of 19:38, 15 May 2019
Line 26:		Line 26:
	A rule set to ''Enable Block if Recommended is Log'' will likely set that smaller and "safer" set of signatures to Block whereas ''Enable Block'' will likely set a larger set of signatures with more potential to disrupt legitimate traffic on your network.		A rule set to ''Enable Block if Recommended is Log'' will likely set that smaller and "safer" set of signatures to Block whereas ''Enable Block'' will likely set a larger set of signatures with more potential to disrupt legitimate traffic on your network.

	=== How can I exclude network processing for signatures ===		=== How can I exclude network processing for signatures? ===

	Create a variable with the network you wish to exclude in standard CIDR format such as 192.168.1.0/24. If you have multiple networks to exclude, create a comma-separated list surrounded by square brackets such as [192.168.25.1.0/24,10.10.0.0/24].		Create a variable with the network you wish to exclude in standard CIDR format such as 192.168.1.0/24. If you have multiple networks to exclude, create a comma-separated list surrounded by square brackets such as [192.168.25.1.0/24,10.10.0.0/24].

Cblaise at 19:38, 15 May 2019

2019-05-15T19:38:02Z

← Older revision		Revision as of 19:38, 15 May 2019
Line 25:		Line 25:
	The difference is that a signature's ''Recommended Action'' (almost always either Log or Disabled) is carefully considered by the signature provider.		The difference is that a signature's ''Recommended Action'' (almost always either Log or Disabled) is carefully considered by the signature provider.
	A rule set to ''Enable Block if Recommended is Log'' will likely set that smaller and "safer" set of signatures to Block whereas ''Enable Block'' will likely set a larger set of signatures with more potential to disrupt legitimate traffic on your network.		A rule set to ''Enable Block if Recommended is Log'' will likely set that smaller and "safer" set of signatures to Block whereas ''Enable Block'' will likely set a larger set of signatures with more potential to disrupt legitimate traffic on your network.

			=== How can I exclude network processing for signatures ===

			Create a variable with the network you wish to exclude in standard CIDR format such as 192.168.1.0/24. If you have multiple networks to exclude, create a comma-separated list surrounded by square brackets such as [192.168.25.1.0/24,10.10.0.0/24].

			Next, create a rule to match the signatures you wish to exclude. For Action select Whitelist and then specify the variable you created to either Source or Destination networks.

			NOTE: Unlike other Rule actions, the Whitelist action doesn't enable logging/blocking for rules. Signatures affected by Whitelist rules will still be processed by the first matching non-Whitelist Rule.

Hpaunet: /* Can Intrusion Prevention rules be configured differently on Policy Manager racks? */

2019-05-13T19:48:56Z

Can Intrusion Prevention rules be configured differently on Policy Manager racks?

← Older revision		Revision as of 19:48, 13 May 2019
Line 13:		Line 13:
	You're free to change the action of any rule to block signatures as you see fit for your network.		You're free to change the action of any rule to block signatures as you see fit for your network.

	=== Can Intrusion Prevention rules be configured differently ~~on Policy Manager racks~~? ===		=== Can Intrusion Prevention rules be configured differently within different policies? ===

	No. Intrusion Prevention applies to all traffic flowing through Untangle so different configurations are not possible.		No. Intrusion Prevention applies to all traffic flowing through Untangle so different configurations are not possible.

Cblaise at 21:05, 13 November 2018

2018-11-13T21:05:12Z

← Older revision		Revision as of 21:05, 13 November 2018
Line 16:		Line 16:

	No. Intrusion Prevention applies to all traffic flowing through Untangle so different configurations are not possible.		No. Intrusion Prevention applies to all traffic flowing through Untangle so different configurations are not possible.

			=== What is the difference between rule block actions? ===

			''Enable Block if Recommended is Log'' will only enable a signature to Block if its ''Recommended Action'' is Log.

			''Enable Block'' will unconditionally set all matching signatures to Block.

			The difference is that a signature's ''Recommended Action'' (almost always either Log or Disabled) is carefully considered by the signature provider.
			A rule set to ''Enable Block if Recommended is Log'' will likely set that smaller and "safer" set of signatures to Block whereas ''Enable Block'' will likely set a larger set of signatures with more potential to disrupt legitimate traffic on your network.

Cblaise at 15:16, 12 November 2018

2018-11-12T15:16:09Z

← Older revision		Revision as of 15:16, 12 November 2018
Line 16:		Line 16:

	No. Intrusion Prevention applies to all traffic flowing through Untangle so different configurations are not possible.		No. Intrusion Prevention applies to all traffic flowing through Untangle so different configurations are not possible.

	~~=== Why has Untangle has switched to Emerging Threat rules? ===~~

	~~We feel they better reflect real-world uses for our customer environments. By default, more are enabled for logging.~~

	~~=== Why is this rule set smaller? ===~~

	~~The previous rule set had a considerable amount that was marked deleted.~~

	~~=== How does this affect my IPS deployment? ===~~

	For most customer who have configured through the IPS Wizard there will be more rules enabled for logging and slightly more memory usage. If you had any rules configured to block, those settings could be changed due to removed rules.

Cblaise: /* Why is this rule set smaller? */

2018-11-12T15:15:03Z

Why is this rule set smaller?

← Older revision		Revision as of 15:15, 12 November 2018
Line 24:		Line 24:

	The previous rule set had a considerable amount that was marked deleted.		The previous rule set had a considerable amount that was marked deleted.


	=== How does this affect my IPS deployment? ===		=== How does this affect my IPS deployment? ===

	For most customer who have configured through the IPS Wizard there will be more rules enabled for logging and slightly more memory usage. If you had any rules configured to block, those settings could be changed due to removed rules.		For most customer who have configured through the IPS Wizard there will be more rules enabled for logging and slightly more memory usage. If you had any rules configured to block, those settings could be changed due to removed rules.

Cblaise: /* Why has Untangle has switched to Emerging Threat rules? */

2018-11-12T15:14:55Z

Why has Untangle has switched to Emerging Threat rules?

← Older revision		Revision as of 15:14, 12 November 2018
Line 20:		Line 20:

	We feel they better reflect real-world uses for our customer environments. By default, more are enabled for logging.		We feel they better reflect real-world uses for our customer environments. By default, more are enabled for logging.


	=== Why is this rule set smaller? ===		=== Why is this rule set smaller? ===

Cblaise: /* Can Intrusion Prevention rules be configured differently on Policy Manager racks? */

2018-11-12T15:14:43Z

Can Intrusion Prevention rules be configured differently on Policy Manager racks?

← Older revision		Revision as of 15:14, 12 November 2018
Line 16:		Line 16:

	No. Intrusion Prevention applies to all traffic flowing through Untangle so different configurations are not possible.		No. Intrusion Prevention applies to all traffic flowing through Untangle so different configurations are not possible.


	=== Why has Untangle has switched to Emerging Threat rules? ===		=== Why has Untangle has switched to Emerging Threat rules? ===