User's Manual

Security Services
Intrusion Prevention Service
Cisco ISA500 Series Integrated Security Appliance Administrator Guide 218
7
- To save the IPS logs to the remote syslog server if you have a remote
syslog server support, you need to enable the Log feature, specify the
Remote Log settings, and check the Remote Log boxes for the IPS
(signature based) and IPS (reputation based) log facilities.
For more information about how to configure the log settings and log
facilities, and how to view the logs, see Log Management, page 302.
• Email Alert Threshold: Enter the value of the email alert threshold. When the
hit count is over the email alert threshold, an alert email is sent to the
specified email acount.
To send the IPS alert emails to the specified email accont, you first need to
enable the IPS Alert feature and configure the email account settings, see
Configuring the Email Alert Settings, page 316.
STEP 4 Click Save to apply your settings.
Blocking the Instant Messaging and Peer-to-Peer
Applications
Use the IM & P2P blocking page to block Instant Message (IM) and Peer-to-Peer
(P2P) traffic on the security appliance.
STEP 1 Click Security Services -> IPS -> IM & P2P Blocking.
The IM & P2P Blocking window opens. The supported IM applications are listed in
the IM Blocking table. The supported P2P applications are listed in the P2P
Blocking table.
STEP 2 Enter the following information:
• IM & P2P Blocking Enable: If you enable IPS, click On to enable the IM and
P2P Blocking settings.
• View IM Blocking Item: Allows you to view the signatures under a specific
IM application.
For example, if you choose MSN, only the signatures under the MSN
application are displayed. To display all signatures, choose All.
• View P2P Blocking Item: Allows you to view the signatures under a specific
P2P application.