86
6.3 group
The freeGuard 100 IPS matches network traffic against patterns contained in attack signatures. Attack
signatures reliably protect your network from known attacks. freedom9’s infrastructure ensures the
rapid identification of new threats and the development of new attack signatures.
You can configure the freeGuard 100 to automatically check for and download an updated attack
definition file containing the latest signatures, or you can manually download the updated attack
definition file. You can also configure the freeGuard 100 to allow push updates of updated attack
definition files as soon as they are available from the Distribution Network. For details, see “config
system autoupdate schedule” and “execute update_now” .
When the freeGuard 100 installs an updated attack definition file, it checks to see if the default
configuration for any existing signatures has changed. If the default configuration has changed, the
changes are preserved.
Signatures are arranged into groups based on the type of attack. By default, all signature groups are
enabled.
You can enable or disable signature groups or individual signatures. Disabling unneeded signatures
can improve system performance and reduce the number of log messages and alert emails that the
IPS generates. For example, the IPS detects a large number of web server attacks. If you do not
provide access to a web server behind your freeGuard 100, you might want to disable all web server
attack signatures.
Some signature groups include configurable parameters. The parameters that are available depend
on the type of signatures in the signature group. When you configure these parameters for a signature
group, the parameters apply to all of the signatures in the group.
For each signature, you can configure the action the freeGuard 100 IPS takes when it detects an
attack. The freeGuard 100 IPS can pass, drop, reset or clear packets or sessions. You can also enable
or disable logging of the attack.
Command syntax pattern
config ips group <group-name_str>
set <keyword> <variable>
end
config ips group <group-name_str
unset <keyword>
end
get ips group [<name_str>]
show ips group [<name_str>]
The config ips group command has 1 subcommand.
config rule <rule-name_str>
Summary of Contents for freeGuard 100
Page 1: ...freeGuard 100 UTM Firewall CLI USER S MANUAL P N F0025000 Rev 1 1...
Page 3: ......
Page 7: ......
Page 87: ...80 The config ips anomaly command has 1 subcommand config limit...
Page 183: ...176...
