Table Of Contents - McAfee M-1250 - Network Security Platform Configuration Manual

Contents
Preface ........................................................................................................... v
Introducing McAfee Network Security Platform............................................................................. v
About the guide ............................................................................................................................. v
Audience ....................................................................................................................................... v
Conventions used in this guide .....................................................................................................vi
Related documentation ................................................................................................................vii
Contacting Technical Support ..................................................................................................... viii
Chapter 1 Overview of IPS settings ............................................................ 1
Configuring and setting rule-based policies .................................................................................. 1
Responding to detected attacks .................................................................................................... 2
Packet logging........................................................................................................................2
Sensor actions .......................................................................................................................3
Setting notification for attacks ....................................................................................................... 3
How Network Security Platform calculates severity level.............................................................. 4
Attack categories and severity range .....................................................................................4
Chapter 2 Managing IPS settings ................................................................ 6
Viewing assigned policies ............................................................................................................. 6
Configuring and managing policies ............................................................................................... 7
Managing policies with IPS Policy Editor ...............................................................................8
Managing policies with Reconnaissance Policy Editor ........................................................38
Policy Assignment................................................................................................................46
Managing HTTP response scanning....................................................................................48
Configuring Advanced Policies.................................................................................................... 50
Configuring non-standard ports............................................................................................51
Managing rule sets with the Rule Set Editor ........................................................................53
Managing attack responses using GARE ............................................................................65
User-Defined Signatures action ...........................................................................................65
Setting up Global Auto Acknowledgement...........................................................................66
Using the Incident Generator service...................................................................................67
Exporting and importing policies ..........................................................................................74
Managing alert filters and attack responses................................................................................ 78
Using the Alert Filter Editor ..................................................................................................78
Alert filter assignments .........................................................................................................82
Exporting Alert Filters ...........................................................................................................84
Importing alert filters.............................................................................................................84
Setting up ACLs .......................................................................................................................... 85
Configuring ACL rules ..........................................................................................................85
ACL Syslog Forwarder .........................................................................................................99
XML converter tool for ACL rules .......................................................................................101
Using L3 ACLs for fragmented traffic .................................................................................102
Enabling Secure Socket Layer (SSL) Decryption ..................................................................... 104
Enabling SSL decryption in IPS Settings node ..................................................................105
Importing SSL keys to the Sensors....................................................................................106
Managing the imported SSL keys of Sensors ....................................................................107
IPS Quarantine settings ............................................................................................................ 108
IPS Quarantine configuration in Policy Editors ..................................................................109
IPS Quarantine configuration in Admin Domain.................................................................115
IPS Quarantine settings in the Threat Analyzer .................................................................123
Archiving data............................................................................................................................ 128
Viewing scheduled actions.................................................................................................128
Archiving alerts and packet logs ........................................................................................128
Scheduling automatic archival ...........................................................................................130
iii