Enabling Intrusion Prevention Services

To configure IPS settings for one or more SonicWALL appliances, complete the following steps:

1	Select the global icon, a group, or a SonicWALL appliance.

2	Expand the Security Services tree and click Intrusion Prevention. The Intrusion Prevention page appears.

 

3	Check Enable IPS to enable the service.

4	Select the check boxes of the interface ports to monitor.

5	Configure the following settings for High Priority Attacks in the IPS Settings area:

•	To to detect, log, and prevent all high priority attacks, select Prevent All.

•	To detect and log all high priority attacks, select Detect All.

•

To prevent the log from becoming overloaded with entries for the same attack, enter a value in the Log Redundancy Filter field. For example, if you entered a value of 30 seconds and there were 100 SubSeven attacks during that period of time, only one attack would be logged during that 30 second period.

6	Repeat Step 5 for the remaining categories as applicable, including Medium Priority Attacks, Low Priority Attacks, IM (Instant Messaging) Applications, and P2P (Peer-to-Peer) Applications.

7	Click Configuring IPS Settings to choose one of the following options:

•	If Enable IP Reassembly is enabled, the SonicWALL security appliance reassembles fragmented packets for full application layer inspection.

•	If Prevent Invalid Checksum is enabled, the SonicWALL security appliance automatically drops and resets the connection, to prevent the traffic from reaching its destination.

•	If Detect Invalid Checksum is enabled, the SonicWALL security appliance logs and alerts any traffic, but does not take any action against the traffic. The connection proceeds to its intended destination.

•	If Enable IPS Exclusion List is selected, the Dell SonicWALL security appliance bypasses IPS enforcement for a specified IP range or address object. Select one of the following:

•	Use Address Object — Select an address object from the drop-down list.

•	Use Address Range — Click Add IPS Range, then enter an IP address range to exclude.

8	To force the firmware to download all signatures, click Update IPS Signature Database.

9	To reset your IPS settings to the defaults, click Reset IPS Settings & Policies.

10	When you are finished, click Update. The settings are changed for each selected SonicWALL appliance. To clear all screen settings and start over, click Reset.