Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [ips]

A Intrusion Prevention System (IPS) is a type of network security system which provides some level of proactive, automated defense against unauthorized access.

49 questions
0
votes
1 answer

Anyway to limit IP Access for Certain Users?

I am currently tasked with allowing Vendors onto our process network. The issue is I need to make it so each vendor is only able to connect to PLCs on their own machines "each PLC has its own IP". Is there a way to limit what IP addresses a windows…
Wally
  • 13
  • 1
  • 3
0
votes
1 answer

Is there a benefit from using an IPS for outgoing traffic?

It's probably a stupid question, but still may be it will be useful not only for me. I have an Juniper SRX firewall in a branch office. All ports are blocked from Internet to Internal network. All ports are opened from Internal network to…
Roman_T
  • 341
  • 1
  • 5
  • 16
0
votes
1 answer

only allow a specific port that can be connected by only one ip address at the same time

I have a open port, 40002, I want to limit that at the same time the port can only be connected by one ip address(not specific address). if there is an ip address conntecing to that port already, other IPs will fail to connect. is is possible…
kenyang001
  • 1
  • 1
0
votes
1 answer

SNORT: Is a PCRE on SSNs intensive

I'm trying to write a Snort rule to look for SSNs. Due to the limitations of the appliance in place I can not use the pre-processor settings. How intense would it be to run a PCRE rule for SSNs? This would essentially perform a regex comparison…
HatinCisco9234
  • 1
  • 1
0
votes
1 answer

Forcing traffic through an IPS on a flat network through a bump in the wire

I have the following topology: Click here, unfortunently I don't have enough rep to post images Essentially I would like the packet flow to go from PC1, to the Core Switch, to the Edge Switch, and to the Firewall. I need to "bump the wire" to force…
HatinCisco9234
  • 1
  • 1
0
votes
0 answers

Inter-VLAN Malicious Code Scanning

I am trying to find an inbuilt solution on a Cisco Catayst 3750X Switch to scan all traffic routed from one VLAN to another for malicious code. The situation is that we currently have a development environment which is currently being redesigned to…
Jackthedog
  • 1
0
votes
6 answers

Sidewinder Firewall Replacement/Alternative

We own a Sidewinder G2 110D (out-of-stock) and love it. The product was reasonably priced, support was great, and the device was rock-solid. Since McAffee bought out SecureComputing, they have eradicated this level of firewall from their line-up. We…
Sysadminicus
  • 596
  • 4
  • 8
  • 20
0
votes
1 answer

Is a reverse proxy useful behind a load balancer and IPS

We have a Web infrastructure with a farm of Web Servers. They are behind a loadbalancer which does SSL offload. We also have a IPS and obviously a set of firewalls. Now, for security reason we have been asked to look into the possibility of adding a…
Momo
  • 1
0
votes
2 answers

Sonicwall IPS blocking Simple Help direct connection

We host a remote access tool called Simple Help. It allows us to access our clients computers and assist them with problems. I can log into it from my remote workstation, and connect to a clients workstation via our server. Then upon a successfully…
skinneejoe
  • 274
  • 2
  • 8
  • 20
0
votes
1 answer

Bridge Intrusion Prevention Vyatta

I am trying to create a bridge with ThreatStop, IPS and block a few ports. This bridge will sit in front of my servers. All is working apart from the IPS. I have read the documentation on configuring IPS, I have something configured that it hasn't…
Steve
  • 188
  • 4
0
votes
1 answer

How to temporarily disable a Cisco IPS module for troubleshooting

I have a Cisco IPS module running in my ASA 5510 firewall. Right now I'm trying to troubleshoot a network/VPN problem that two of my users are having when they VPN into a remote partners site. I would like to turn off the IPS module to determine if…
Richard West
  • 2,978
  • 12
  • 44
  • 49
0
votes
1 answer

Switch Before Firewall / Router - Multiple public IPs

I currently Have a 10Mbit Full duplex circuit connected to a small unmanaged switch which then connects to a Sonicwall Firewall / Router. I have several public IP addresses (/28) that are assigned to several devices in my setup. Now the problem is…
rii
  • 1
  • 1
  • 1
0
votes
1 answer

Looking for a good DDOS IPS system

Could I get some recommendations on an IPS solutions that incorporates some form of DDOS protection / what do you currently implement on your network? Thanks
james moore
  • 219
  • 1
  • 3
  • 7
0
votes
1 answer

How Does Cisco IPS Work?

How does it work? Does it typically have predefined patterns of trusted or malicious activity? Is it actually a category of firewall techniques? I am more curious about Cisco than I am about other products..
700 Software
  • 2,233
  • 10
  • 49
  • 77
0
votes
1 answer

Snort DAQ: which NIC should run in promiscuous mode?

I want to use Snort 2.x as IPS. I have understood, that I need two NICs to capture the traffic (DAQ-Mode). eth0 = my network card to the WAN eth1 = my internal (virtual) NIC for Snort. My current Run-Command: snort -u snort -g snort -c…
Gill-Bates
  • 585
  • 2
  • 8
  • 23
1 2
3
4