User's Manual

Security Services
Intrusion Prevention Service
Cisco ISA500 Series Integrated Security Appliance Administrator Guide 215
7
This section includes the following topics:
• General IPS Settings, page 215
• Configuring the IPS Policy and Protocol Inspection, page 216
• Blocking the Instant Messaging and Peer-to-Peer Applications,
page 218
General IPS Settings
Use the IPS Setup page to enable or disable the IPS service, choose the security
zones you want to protect, update the IPS signatures, and view the IPS signature
status and logs.
STEP 1 Click Security Services -> IPS -> IPS Setup.
The IPS Setup window opens.
STEP 2 Click On to enable IPS, or Click Off to disable IPS.
STEP 3 Specify the zones to block the intrusion for incoming traffic from the selected
zones:
• WAN zone: Choose this option to block the intrusion for incoming traffic from
the WAN zone. This is the default setting.
• WAN + VPN zone: Choose this option to block the intrusion for incoming
traffic from both WAN and VPN zones.
• All zones: Choose this option to block the intrusion for the incoming traffic
from all zones.
STEP 4 In the IPS Status area, you can perform the following tasks:
• IPS Signatures: Displays the status of IPS signature file, including the
expiration date of the security license, the name of the signature file, and the
date and time of your last signature update.
• View IPS Logs: IPS logs a message if an attack is detected. Click this button
to view all IPS log messages.
• Email Alert Setting: IPS sends an alert message to the specified email
account if an attack hits the email alert threshold. Click this link to see the
email alert settings for IPS Alert events.