A new, updated signature database is downloaded automatically by NetDefendOS system at a
configurable interval. This is done via an HTTP connection to the D-Link server network which
delivers the latest signature database updates. If the server's signature database has a newer version
than the current local database, the new database will be downloaded, replacing the older version.
The Terms IDP, IPS and IDS
The terms Intrusion Detection and Prevention (IDP), Intrusion Prevention System (IDP) and
Intrusion Detection System (IDS) are used interchangeably in D-Link literature. They all refer to the
same feature, which is IDP.
Setting the Correct System Time
It is important that a NetDefendOS has the correct system time set if the auto-update feature in the
IDP module can function correctly. An incorrect time can mean the auto-updating is disabled.
The console command
> updatecenter -status
will show the current status of the auto-update feature. This can also be done through the WebUI.
Updating in High Availability Clusters
Updating the IDP databases for both the NetDefend Firewalls in an HA Cluster is performed
automatically by NetDefendOS. In a cluster there is always an active unit and an inactive unit. Only
the active unit in the cluster will perform regular checking for new database updates. If a new
database update becomes available the sequence of events will be as follows:
1.
The active unit determines there is a new update and downloads the required files for the
update.
2.
The active unit performs an automatic reconfiguration to update its database.
3.
This reconfiguration causes a failover so the passive unit becomes the active unit.
4.
When the update is completed, the newly active unit also downloads the files for the update
and performs a reconfiguration.
5.
This second reconfiguration causes another failover so the passive unit reverts back to being
active again.
These steps result in both NetDefend Firewalls in a cluster having updated databases and with the
original active/passive roles. For more information about HA clusters refer to Chapter 11, High
Availability.
6.5.3. IDP Rules
Rule Components
An IDP Rule defines what kind of traffic, or service, should be analyzed. An IDP Rule is similar in
makeup to an IP Rule. IDP Rules are constructed like other security policies in NetDefendOS such
as IP Rules. An IDP Rule specifies a given combination source/destination interfaces/addresses as
well as being associated with a service object which defines the IDP rules that will be used during
traffic scanning. A time schedule can also be associated with an IDP Rule. Most importantly, an IDP
Rule specifies the Action to take on detecting an intrusion in the traffic targeted by the rule.
6.5.3. IDP Rules
Chapter 6. Security Mechanisms
322
Summary of Contents for NetDefend DFL-260E
Page 27: ...1 3 NetDefendOS State Engine Packet Flow Chapter 1 NetDefendOS Overview 27...
Page 79: ...2 7 3 Restore to Factory Defaults Chapter 2 Management and Maintenance 79...
Page 146: ...3 9 DNS Chapter 3 Fundamentals 146...
Page 227: ...4 7 5 Advanced Settings for Transparent Mode Chapter 4 Routing 227...
Page 241: ...5 4 IP Pools Chapter 5 DHCP Services 241...
Page 339: ...6 7 Blacklisting Hosts and Networks Chapter 6 Security Mechanisms 339...
Page 360: ...7 4 7 SAT and FwdFast Rules Chapter 7 Address Translation 360...
Page 382: ...8 3 Customizing HTML Pages Chapter 8 User Authentication 382...
Page 386: ...The TLS ALG 9 1 5 The TLS Alternative for VPN Chapter 9 VPN 386...
Page 439: ...Figure 9 3 PPTP Client Usage 9 5 4 PPTP L2TP Clients Chapter 9 VPN 439...
Page 450: ...9 7 6 Specific Symptoms Chapter 9 VPN 450...
Page 488: ...10 4 6 Setting Up SLB_SAT Rules Chapter 10 Traffic Management 488...
Page 503: ...11 6 HA Advanced Settings Chapter 11 High Availability 503...
Page 510: ...12 3 5 Limitations Chapter 12 ZoneDefense 510...
Page 533: ...13 9 Miscellaneous Settings Chapter 13 Advanced Settings 533...
