Settings

This section reviews the different settings and configuration options available for Firewall.

Status

This displays the current status and some statistics.

Rules

The Rules tab allows you to specify rules to Block, Pass or Flag traffic that crosses the NG Firewall.

The Rules documentation describes how rules work and how they are configured. Firewall uses rules to determine to block/pass the specific session and if the sessions is flagged. Flagging a session marks it in the logs for reviewing in the event logs or reports, but has no direct effect on the network traffic.

Typically NG Firewall is installed as a NAT/gateway device, or behind another NAT/gateway device in bridge mode. In this scenario all inbound sessions are blocked by NAT except those explicitly allowed with port forwards. Because of this, the Firewall does not block anything by default. It is up to you to decide the best fit for your network, whether you only want to block specific ports or you want to block everything and allow only a few services.

Additionally, a session can be flagged. If the Flag is checked, the event is flagged for easier viewing in the event log. Flag is always enabled if the action is Block.

Reports

The Reports tab provides a view of all reports and events for all traffic handled by Firewall.

This applications reports can be accessed via the Reports tab at the top or the Reports tab within the settings. All pre-defined reports will be listed along with any custom reports that have been created.

Reports can be searched and further defined using the time selectors and the Conditions window at the bottom of the page. The data used in the report can be obtained on the Current Data window on the right.

Related Topics

NG Firewall User Guide

Settings

When To Scan

Intrusion Prevention can be run before or after other network processing. Which option depends largely on your reasons for using Intrusion Prevention.

When Before other Network Processing is selected (the default), IPS sees all traffic, even if it will subsequently be dropped by the firewall. This means IPS will see much malicious activity like port scans intrusion attempts on the public IP addresses on almost all networks, even though that traffic will ultimately just be dropped. The advantage of this approach is that Intrusion Prevention sees and logs everything, providing the most complete picture. The disadvantage is that it usually logs so much that the Intrusion Prevention event log quickly becomes ignored because it logs thousands of events per day and this is completely normal and expected.

When After other Network Processing is selected, IPS will only scan traffic that will pass through the firewall. Most networks where an NG Firewall is running with a Public IP and doing NAT and only port forwarding select or no traffic at all, this will be extremely different from scanning "prerouting". The advantage of this mode is that IPS will only scan/log on traffic that is entering your network and, therefore, ignores a lot of the standard "noise" from incoming port scans and vulnerability scans that just get dropped at the firewall and logs only on traffic that should potentially concern the administrator. Another advantage is that it fully allows bypass traffic to work as expected. The disadvantage of this mode is that it provides a less complete picture of activity on the public interface it now no longer logs attempts that just get dropped.

Status

Rules

Rules allow you to control which signatures are enabled (and their actions) or disabled. For each signature, the rules are evaluated in order, and the action from the first matching rule is used to determine the status of that signature. The Intrusion Prevention rules are the mechanism to determine which signatures are enabled and their associated actions. These rules have no impact on network traffic and are not evaluated against packets, sessions, or network traffic in any manner.

Any signature not matched by any rule is disabled.

The Rules documentation describes how rules generally work and how they are configured. The major difference for Intrusion Prevention is the Conditions List.

At the bottom of the tab, a stats bar indicates how many signatures are affected by the currently defined rules.

When adding or editing a rule, the bottom of the edit window will show how many signatures are affected by the conditions as you build the rule.

Rule Conditions

Conditions define which signatures will match the rule. If and only all conditions match, the rule is considered a match.

Rule Actions

Signatures

The Signature tab shows the entire database of signatures, both the defaults set provided as well as any custom signatures you may add.

Navigation

By default, signatures are grouped by classtype, and you can expand the groups to view the individual signatures.

To better find specific signatures, you can use the Filter to select signature fields and the match you're looking for. The grid view will change to show those signatures matching the filter.

If your filter returned one or more matches, you can create a rule from the filter by clicking Create Rule.

Mousing over a grid cell will show appropriate information related to that cell. For example, if you mouse over the Rule Action cell, you'll see which rule is affecting this signature.

Custom Signatures

You may create and maintain your signatures, but most use the default database.

If you want to add custom signatures you can do so either by clicking Add.

Variables

This tab provides administrators access to Suricata variables. These variables are used in rules to specify criteria for the source and destination of a packet.

Suricata's most important variable is $HOME_NET. $HOME_NET defines the network or networks you are trying to protect - it is computer automatically based on your network configuration - it includes all local networks (including aliases). Under nearly every circumstance, you will want to leave these values as-is.

Using the Add button, custom variables can be added. Adding variables may be used by users who are adding their own rules. This should only be attempted by advanced users with a strong knowledge of Suricata signature creation.

Bypass Rules

Bypass rules enable you to configure traffic that should not be scanned by Intrusion Prevention. The Rules documentation describes how rules generally work and how they are configured.

Updates

The signature database is checked automatically every night. Updates are typically released 2-3 times a week. The signature database does not affect custom signatures. New signatures will be integrated into Intrusion Prevention according to defined rules.

Reports

The Reports tab provides a view of all reports and events for all traffic handled by Intrusion Prevention.

This application's reports can be accessed via the Reports tab at the top or the Reports tab within the settings. All pre-defined reports will be listed along with any custom reports that have been created.

The tables queried to render these reports:

• Database Schema

All Events

The All Events report shows all enabled signature matches found by Intrusion Prevention.

If there are signatures that are currently set to an action of Log and you determine the signature should, be Block, you can click the Block button on the far right. The Block button is disabled for any signature that is already blocked.

Related Topics

• Intrusion Prevention Systems
• Suricata - Writing Suricata Signatures

Settings

This section reviews the different settings and configuration options available for Phish Blocker.

Status

This displays the current status and some statistics.

Email

If set to Mark, "[Phish]..." will be prepended to the email subject line and it will be delivered. If set to Pass, the message will be delivered as originally sent. Drop will inform the sending server the mail was successfully delivered, but NG Firewall will drop the mail so it is never delivered. Quarantine will send the mail to users' email quarantine for them to release or delete as they see fit. For more information, refer to Quarantine.

Reports

The Reports tab provides a view of all reports and events for all traffic handled by Phish Blocker.

This applications reports can be accessed via the Reports tab at the top or the Reports tab within the settings. All pre-defined reports will be listed along with any custom reports that have been created.

Related Topics

• Spam Blocker
• NG Firewall Filter Apps

Settings

This section reviews the different settings and configuration options available for the virus scanners.

Status

This displays the current status and some statistics.

Scan Options

Pass Sites

Advanced

The first option can enable/disable certain scanners. When a file is scanned by a virus blocker, it is scanned by multiple engines, a local antivirus engine, and the cloud ScoutIQ™ engine.

Using all available engines is recommended.

File Extensions

File extensions configure which HTTP files will be scanned. The defaults are the recommended values. However, in some cases, you may want to add or remove certain file extensions.

An understanding of security tradeoffs and pragmatism is essential before changing these settings. Unlike the other URL-based scanning of other apps like Web Filter, Virus Blocker runs in depth analysis of the file, including signatures, heuristics, and emulation. Unlike host-based antivirus, the gateway is a unique resource shared among the whole network. Furthermore, it has no ability to scan-on-exec as it has no knowledge of what the client plans to execute, unlike host-based antivirus. Scanning is expensive, and turning on certain extensions (like .png files) can cripple the network. Analyzing reports to see how many scans are being done and if those resources are being spent on worthwhile scan resources is a good exercise. It is not uncommon to see millions of scans of some application's update.

MIME Types

Similar to file extensions, but this lists the MIME types to be scanned, regardless of extension. The same logic and warnings apply here as well.

Reports

The Reports tab provides a view of all reports and events for all traffic handled by Virus Blocker Lite.

This applications reports can be accessed via the Reports tab at the top or the Reports tab within the settings. All pre-defined reports will be listed along with any custom reports that have been created.

Reports can be searched and further defined using the time selectors and the Conditions window at the bottom of the page. The data used in the report can be obtained on the Current Data window on the right.

The tables queried to render these reports:

• Sessions
• Session Minutes
• Virus Blocker Lite Reports

Related Topics

Virus Blocker

Status

This displays the current status and some statistics.

Scan Options

Scan options configure what network traffic and content to scan.

• Scan HTTP: This enables or disables HTTP scanning.
• Scan SMTP: This option enables the scanning of SMTP message attachments.
• Action: The selected action will be taken on a message if a virus is found.

  Setting Action to Remove Infection will remove the infected attachment and wrap the original email for delivery to the intended recipient. If set to Pass Message, the original message will be wrapped and delivered with the attachment intact. In both cases, the subject line is prepended with "[VIRUS]". Block will block the message from being delivered.

• Scan FTP: This enables or disables scanning of FTP downloads.
  

Pass Sites

For each protocol, the behavior is as follows:

• HTTP: Match the HTTP Host header.
• FTP: Match the server IP address or domain address (if a reverse DNS address exists).
• Email: Match the client or server IP address or domain address (if a reverse DNS address exists).
  

Advanced

Advanced settings can tune specific behavior of virus blockers.

The first option can enable/disable certain scanners. When a file is scanned by a virus blocker, it is scanned by multiple engines, a local antivirus engine, and the cloud ScoutIQ™ engine.

Using all available engines is recommended.

File Extensions

File extensions configure which HTTP files will be scanned. The defaults are the recommended values. However, in some cases, you may want to add or remove certain file extensions.

An understanding of security tradeoffs and pragmatism is essential before changing these settings. Unlike the other URL-based scanning of other apps like Web Filter, Virus Blocker runs in depth analysis of the file, including signatures, heuristics, and emulation. Unlike host-based antivirus, the gateway is a unique resource shared among the whole network, andit has no ability to scan-on-exec as it has no knowledge of what the client plans to execute, unlike host-based antivirus. Scanning is expensive, and turning on certain extensions (like .png files) can cripple the network. Analyzing reports to see how many scans are being done and if those resources are being spent on worthwhile scan resources is a good exercise. It is not uncommon to see millions of scans of some application's update.

MIME Types

Similar to file extensions, but this lists the MIME types to be scanned, regardless of extension. The same logic and warnings apply here as well.