SourceNetwork=wannet
DestinationInterface=dmz
DestinationNetwork=ip_mailserver
Name=IDPMailSrvRule
Specify the Rule Action:
gw-world:/> cc IDPRule IDPMailSrvRule
gw-world:/IDPMailSrvRule> add IDPRuleAction Action=Protect
IDPServity=All Signatures=IPS_MAIL_SMTP
Web Interface
Create an IDP Rule:
This IDP rule is called IDPMailSrvRule, and applies to the SMTP service. Source Interface and Source Network
define where traffic is coming from, in this example, the external network. The Destination Interface and
Destination Network define where traffic is directed to, in this case the mail server. Destination Network should
therefore be set to the object defining the mail server.
1.
Go to IDP > IDP Rules > Add > IDP Rule
2.
Now enter:
•
Name: IDPMailSrvRule
•
Service: smtp
•
Also inspect dropped packets: In case all traffic matching this rule should be scanned (this also means
traffic that the main rule set would drop), the Protect against insertion/evasion attacks checkbox
should be checked, which is the case in this example.
•
Source Interface: wan
•
Source Network: wannet
•
Destination Interface: dmz
•
Destination Network: ip_mailserver
•
Click OK
Specify the Action:
An action is now defined, specifying what signatures the IDP should use when scanning data matching the rule,
and what NetDefendOS should do when a possible intrusion is detected. In this example, intrusion attempts will
cause the connection to be dropped, so Action is set to Protect. The Signatures option is set to
IPS_MAIL_SMTP in order to use signatures that describe attacks from the external network that are based on the
SMTP protocol.
1.
Select the Rule Action tab for the IDP rule
2.
Now enter:
•
Action: Protect
•
Signatures: IPS_MAIL_SMTP
•
Click OK
If logging of intrusion attempts is desired, this can be configured by clicking in the Rule Actions tab when
creating an IDP rule and enabling logging. The Severity should be set to All in order to match all SMTP attacks.
In summary, the following will occur: If traffic from the external network to the mail server occurs, IDP will be
activated. If traffic matches any of the signatures in the IPS_MAIL_SMTP signature group, the connection will be
dropped, thus protecting the mail server.
Using Individual Signatures
The preceding example uses an entire IDP group name when enabling IDP. However, it is possible
6.5.8. SMTP Log Receiver for IDP
Events
Chapter 6. Security Mechanisms
330
Summary of Contents for NetDefend DFL-260E
Page 27: ...1 3 NetDefendOS State Engine Packet Flow Chapter 1 NetDefendOS Overview 27...
Page 79: ...2 7 3 Restore to Factory Defaults Chapter 2 Management and Maintenance 79...
Page 146: ...3 9 DNS Chapter 3 Fundamentals 146...
Page 227: ...4 7 5 Advanced Settings for Transparent Mode Chapter 4 Routing 227...
Page 241: ...5 4 IP Pools Chapter 5 DHCP Services 241...
Page 339: ...6 7 Blacklisting Hosts and Networks Chapter 6 Security Mechanisms 339...
Page 360: ...7 4 7 SAT and FwdFast Rules Chapter 7 Address Translation 360...
Page 382: ...8 3 Customizing HTML Pages Chapter 8 User Authentication 382...
Page 386: ...The TLS ALG 9 1 5 The TLS Alternative for VPN Chapter 9 VPN 386...
Page 439: ...Figure 9 3 PPTP Client Usage 9 5 4 PPTP L2TP Clients Chapter 9 VPN 439...
Page 450: ...9 7 6 Specific Symptoms Chapter 9 VPN 450...
Page 488: ...10 4 6 Setting Up SLB_SAT Rules Chapter 10 Traffic Management 488...
Page 503: ...11 6 HA Advanced Settings Chapter 11 High Availability 503...
Page 510: ...12 3 5 Limitations Chapter 12 ZoneDefense 510...
Page 533: ...13 9 Miscellaneous Settings Chapter 13 Advanced Settings 533...
