Specifications

WAN Configuration 4-9
4.3 Configuring Intrusion Prevention System
IP networks are vulnerable to security breaches by attackers exploiting known bugs in installed softwares.
These attacks can originate from any host on the network or from devices outside the network. These attacks
can either be intentional or un-intentional. If such an attack succeeds, the attacker could get access to vital
and sensitive information stored on the host or can execute malicious code on the host or just prevent the
host or hosts from functioning normally.
Intrusion Prevention System (IPS) works alongside the firewall to detect vulnerability to such attacks. Any
packet that flows through the network is examined by the IPS. Unlike the firewall which examines and blocks
traffic based on IP addresses and ports, the IPS looks at different fields of the network traffic and then
manages the traffic based on pre-defined patterns called “Signatures”.
A signature is based on the protocol, source/destination ports, and the data pattern of the load. The
signature also defines the action to be taken when an attack is detected. The action can be one of:
• Drop the connection (in case of TCP connection)
• Drop the packet
• Generate an informative log message and then allow the packet through.
Each and every packet entering or leaving the network is matched and the appropriate action taken.
1. IPS can be configured from the Network Configuration --> Firewall menu. The following screen
appears.
Scroll to the bottom of the window to configure IPS settings.