Settings

This section reviews the different settings and configuration options available for Firewalls.

Status

This displays the current status and some statistics.

Rules

The Rules tab allows you to specify rules for blocking, Passing, or Flagging traffic that crosses the NG Firewall.

The Rules documentation describes how rules work and how they are configured. The firewall uses rules to determine whether to block/pass a specific session and whether it is flagged. Flagging a session marks it in the logs for review in the event logs or reports but has no direct effect on network traffic.

Typically, the NG firewall is installed as a NAT/gateway device or behind another NAT/gateway device in bridge mode. In this scenario, all inbound sessions are blocked by NAT except for those explicitly allowed with port forwards. Because of this, the Firewall does not block anything by default. It is up to you to decide the best fit for your network, whether you only want to block specific ports or block everything and allow only a few services.

Additionally, a session can be flagged. If the Flag is checked, the event is flagged in the event log for easier viewing. The flag is always enabled if the action is blocked.

Related Topics

NG Firewall User Guide

Settings

When To Scan

Intrusion Prevention can be run before or after other network processing. Which option depends largely on your reasons for using Intrusion Prevention.

When other Network Processing is selected (the default), IPS sees all traffic, even if the firewall will subsequently drop it. This means IPS will see much malicious activity, such as port scans and intrusion attempts on the public IP addresses on almost all networks, even though that traffic will ultimately be dropped. The advantage of this approach is that Intrusion Prevention sees and logs everything, providing the most complete picture. The disadvantage is that it usually logs so much that the Intrusion Prevention event log quickly becomes ignored because it logs thousands of events daily, which is normal.

IPS only scans traffic passing through the firewall when other Network Processing is selected. For most networks where an NG firewall is running with a public IP and doing NAT and only port forwarding select or no traffic at all, this will be extremely different from scanning "prerouting." The advantage of this mode is that IPS will only scan/log on traffic that is entering your network and, therefore, ignores a lot of the standard "noise" from incoming port scans and vulnerability scans that just get dropped at the firewall and logs only on traffic that should potentially concern the administrator. Another advantage is that it fully allows bypass traffic to work as expected. The disadvantage of this mode is that it provides a less complete picture of activity on the public interface, and it no longer logs attempts that just get dropped.

Status

Rules

Rules allow you to control which signatures are enabled (and their actions) or disabled. For each signature, the rules are evaluated in order, and the action from the first matching rule is used to determine the status of that signature. The Intrusion Prevention rules are the mechanism that determines which signatures are enabled and what their associated actions are. These rules have no impact on network traffic and are not evaluated against packets, sessions, or network traffic in any manner.

Any signature not matched by any rule is disabled.

The Rules documentation describes how rules generally work and how they are configured. The major difference between the Intrusion Prevention and Conditions List is that.

A status bar at the bottom of the tab indicates the number of signatures affected by the currently defined rules.

When adding or editing a rule, the bottom of the edit window will show how many signatures are affected by the conditions as you build the rule.

Rule Conditions

Conditions define which signatures will match the rule. If and only all conditions match, the rule is considered a match.

Rule Actions

Signatures

The Signature tab shows the entire signatures database, both the default set provided and any custom signatures you may add.

Navigation

By default, signatures are grouped by classtype, and you can expand the groups to view the individual signatures.

You can use the Filter to select signature fields and the match you're looking for to better find specific signatures. The grid view will change to show those signatures matching the filter.

If your filter returned one or more matches, you can create a rule from the filter by clicking Create Rule.

Mousing over a grid cell will show appropriate information related to that cell. For example, if you mouse over the Rule Action cell, you'll see which rule affects this signature.

Custom Signatures

You may create and maintain your signatures, but most use the default database.

If you want to add custom signatures, you can do so by clicking Add.

Alternatively, if you want to create a new custom signature on an existing signature, you can click Copy then edit that copy.

Variables

This tab provides administrators access to Suricata variables. These variables are used in rules to specify criteria for the source and destination of a packet.

Suricata's most important variable is $HOME_NET. $HOME_NET defines the network or networks you are trying to protect. It is computer-generated automatically based on your network configuration and includes all local networks (including aliases). Under nearly every circumstance, you will want to leave these values as-is.

Custom variables can be added using the Add button. Adding variables may be used by users who are adding their own rules. This should only be attempted by advanced users with a strong knowledge of Suricata signature creation.

Bypass Rules

Bypass rules enable you to configure traffic that Intrusion Prevention should not scan. The Rules documentation describes how rules generally work and how they are configured.

Updates

The signature database is checked automatically every night. Updates are typically released 2-3 times a week. The signature database does not affect custom signatures. New signatures will be integrated into Intrusion Prevention according to defined rules.

All Events

The All Events report shows all enabled signature matches found by Intrusion Prevention.

If signatures are currently set to an action of Log and you determine the signature should be Block, you can click the Block button on the far right. The Block button is disabled for any signature that is already blocked.

Related Topics

• Intrusion Prevention Systems
• Suricata - Writing Suricata Signatures

Settings

This section reviews the different settings and configuration options available for Phish Blocker.

Status

This displays the current status and some statistics.

Email

If set to Mark, "[Phish]..." will be prepended to the email subject line and delivered. If set to Pass, the message will be delivered as originally sent. The drop will inform the sending server the mail was successfully delivered, but the NG Firewall will drop the mail, so it is never delivered. Quarantine will send the mail to users' email quarantine for them to release or delete as they see fit. For more information, refer to Quarantine.

Related Topics

• Spam Blocker
• Spam Blocker Lite

Settings

This section discusses the different settings and configuration options for virus scanners.

Status

This displays the current status and some statistics.

Scan Options

Scan options configure what network traffic and content to scan.

• Scan HTTP: This turns HTTP scanning on or off.
• Scan SMTP: This option enables the scanning of SMTP message attachments.
• Action: If a virus is found, the selected action will be taken on a message.
  1. Setting Action to Remove Infection will remove the infected attachment and wrap the original email for delivery to the intended recipient.
  2. If set to Pass Message, the original message will be wrapped and delivered with the attachment intact.
  3. Note: The subject line is prepended with [VIRUS] in both cases.
  4. Block will block the message from being delivered.
  5. Scan FTP: This turns scanning of FTP downloads on or off.
     
     

Pass Sites

This section allows you to specify sites that are not scanned. The list uses the Glob Matcher syntax.

Note: Use caution when adding sites to this list!

Advanced

Advanced settings can tune specific behavior of virus blockers.

The first option is to turn certain scanners on/off. When a virus blocker scans a file, it is scanned by multiple engines, a local antivirus engine, and the cloud ScoutIQ™ engine.

Using all available engines is recommended.

File Extensions

MIME Types

This is similar to file extensions but lists the MIME types to be scanned regardless of extension. The same logic and warnings apply here as well.

Status

This displays the current status and some statistics.

Scan Options

Pass Sites

This section allows you to specify sites that are not scanned. The list uses the Glob Matcher syntax.

Note: Use caution when adding sites to this list!

Advanced

Advanced settings can tune specific behavior of virus blockers.

The first option is to turn certain scanners on/off. When a virus blocker scans a file, it is scanned by multiple engines, a local antivirus engine, and the cloud ScoutIQ™ engine.

Using all available engines is recommended.

File Extensions

File extensions configure which HTTP files will be scanned. The defaults are the recommended values. However, in some cases, you may want to add or remove certain file extensions.

An understanding of security tradeoffs and pragmatism is essential before changing these settings. Unlike other URL-based scanning of other apps like Web Filter, Virus Blocker runs an in-depth analysis of the file, including signatures, heuristics, and emulation. Unlike host-based antivirus, the gateway is a unique resource shared among the whole network, and it cannot scan on-exec as it does not know what the client plans to execute. Scanning is expensive, and turning on certain extensions (like .png files) can cripple the network. Analyzing reports to see how many scans are being done and if those resources are being spent on worthwhile scan resources is a good exercise. It is common to see millions of scans of some application updates.

MIME Types

Similar to file extensions, but this lists the MIME types to be scanned, regardless of extension. The same logic and warnings apply here as well.