Fortinet Network Device IPS Instrukcja Użytkownika Strona 11
- Strona / 62
- Spis treści
- BOOKMARKI
Oceniono. / 5. Na podstawie oceny klientów
IPS overview and general configuration Monitoring the network and dealing with attacks
FortiGate IPS User Guide Version 3.0 MR7
01-30007-0080-20080916 11
Controlling sessions
Use this command to ignore sessions after a set amount of traffic has passed.
The default is 204800 bytes.
config ips global
set ignore-session-bytes <byte_integer>
end
Setting the buffer size
Set the size of the IPS buffer. The size of the buffer is model-dependent.
config ips global
set socket-size <ips_buffer_size>
end
Monitoring the network and dealing with attacks
After configuring IPS and enabling it in protection profiles, it is time to set up
tracking and notification of attacks. Enabling logging and alert email to maintain
user awareness of attacks on the network.
The next step is dealing with attacks if and when they occur. The FortiGuard
Center at http://www.fortinet.com/FortiGuardCenter/ provides a comprehensive
Attack Encyclopedia to help decide what actions to take to further protect the
network.
This section describes:
• Configuring logging and alert email
• Attack log messages
• The FortiGuard Center
Configuring logging and alert email
Whenever the IPS detects or prevents an attack, it generates an attack log
message that can be recorded or sent as an alert email.
The FortiGate unit categorizes attack log messages by signature or anomaly and
includes the attack name in the log message. Enable logging and alert email for
attack signatures and attack anomalies.
To configure logging and alert email for IPS events using the web-based
manager
1 Go to Log&Report > Log Config > Log Setting.
2 Select and configure the settings for any logging locations to use.
3 Select Apply.
4 Go to Log&Report > Log Config > Alert Email.
Note: Attack and intrusion attempts occur frequently on networks connected to the Internet.
Reduce the number of log messages and alert email by disabling signatures for attacks that the
system is not vulnerable to (for example, web attacks when not running a web server).
- USER GUIDE 1
- Contents 3
- 4 01-30007-0080-20080916 4
- Introduction 5
- About this document 6
- Fortinet documentation 6
- 01-30007-0080-20080916 7 7
- IPS overview and general 9
- Network performance 10
- Controlling sessions 11
- Setting the buffer size 11
- Attack log messages 12
- Signature 12
- The FortiGuard Center 13
- 14 01-30007-0080-20080916 14
- 16 01-30007-0080-20080916 16
- 01-30007-0080-20080916 19 19
- 20 01-30007-0080-20080916 20
- Command syntax pattern 22
- Creating custom signatures 23
- Custom signature syntax 24
- --protocol tcp; 29
- --tcp_flags AP 31
- Example custom signatures 33
- 34 01-30007-0080-20080916 34
- 36 01-30007-0080-20080916 36
- Decoder 38
- IPS sensors 39
- IPS sensor attributes: 41
- IPS sensor filters: 41
- Configuring filters 42
- DoS sensors 45
- Viewing the DoS sensor list 46
- Configuring DoS sensors 46
- DoS sensor attributes: 47
- Anomaly configuration: 47
- Understanding the anomalies 48
- 50 01-30007-0080-20080916 50
- What is SYN threshold? 52
- What is SYN proxy? 52
- 01-30007-0080-20080916 53 53
- ICMP sweep attacks 55
- Predefined ICMP signatures 56
- ICMP sweep anomalies 57
- 58 01-30007-0080-20080916 58
- 60 01-30007-0080-20080916 60
Powiązane produkty i podręczniki dla Sprzęt komputerowy Fortinet Network Device IPS
(2 strony)NEC 60002480 manuales
Manuales del propietario y guías del usuario para Pantallas Led NEC 60002480.
Ofrecemos 1 manuales en pdf NEC 60002480 para descargar gratis por tipos de documentos: Ficha de datos
Komentarze do niniejszej Instrukcji