User's Manual

Security Services
Intrusion Prevention Service
Cisco ISA500 Series Integrated Security Appliance Administrator Guide 216
7
To send alert emails for IPS Alert events, you first need to enable the IPS
Alert feature and configure the email account settings, see Configuring the
Email Alert Settings, page 316. And then configure the IPS Policy and
Protocol Inspection settings and/or the IM and P2P Blocking settings, see
Configuring the IPS Policy and Protocol Inspection, page 216 and
Blocking the Instant Messaging and Peer-to-Peer Applications,
page 218.
STEP 5 The IPS service uses the signatures to identify the attacks in progress. You can
manually or automatically update the IPS signatures.
• Automatic Signature Updates: Click On to automatically update the IPS
signatures periodically if a new signature file is available, or click Off to
disable it.
- User Name: The user name of your registered CCO account used to
download the IPS signature file. To configure the CCO account, click Edit
Account Setting.
- Update: Click this button to immediately update the IPS signatures if a
new signature file is available. The new signature file will be downloaded
from the Cisco server and saved on the flash partition of your device.
• Manual Signature Updates: To manually update the IPS signatures, you first
need to download the latest signature file from the Cisco server to your local
PC. The user name and password of your registered CCO account are
required to log into the Cisco server. Then click Browse to locate and select
the signature file from your local PC, and click Upload.
STEP 6 Click Save to apply your settings.
Configuring the IPS Policy and Protocol Inspection
The IPS Policy protects the network against threats such as Denial-of-Service
attacks, malware, and backdoor exploits. The Protocol Inspection detects
suspicious behavior and attacks on various types of protocols.
STEP 1 Click Security Services -> IPS -> IPS Policy & Protocol Inspection.
The IPS Policy and Protocol Inspection window opens. The IPS categories and
protocols supported on the security appliance are listed in the IPS table.
STEP 2 Enter the following information: