Copying Existing Policies; Configuring The Application Filter Module - Enterasys Intrusion Prevention System Manual

Copying Existing Policies

You can copy any custom or master policy and then paste it as a new custom policy. You cannot
paste custom policies into the Master Policies node.
To copy a policy:
1. Click the Network Policy View icon, and then the Network Policies tab.
2. Right-click a policy and highlight Copy.
3. Right-click Custom Policies and highlight Paste.
A window appears asking you to provide a name for the policy.
4. Enter the name of the policy.
You can enter any alphanumeric characters. Every policy must have a unique name.
5. Click OK.
The policy is added to the tree under Custom Policies.
You can modify all module settings by clicking on the module name. Information about
configuring policy module parameters is provided in the following sections.

Configuring the Application Filter Module

This module defines traffic criteria that can be ignored by the sensor. Use this module to refine the
data that the sensor analyzes, by telling the sensor what types of traffic and packets to ignore. By
reducing the amount of data that the sensor has to look at, and therefore the number of events
generated, you can often improve the performance of the sensor as well as the analysis process.
Application filters are applied before any inspection of data occurs. Therefore, if a filter is
matched, the sensor does not do any further processing of the data — that is what is meant by
saying that the data is "ignored." In general, if you know of a particular class of traffic that can be
ignored (for example, from a particular IP address or VLAN), then you should use a filter, since
this will generally lessen the load on the sensor.
The Application Filter Module has eight tabs, described in the following sections.
For information about...
General Settings Tab
IP Settings Tab
Port Settings Tab
Protocol Settings Tab
VLAN Settings Tab
Probe Settings Tab
Rule Settings Tab
Signature Settings Tab
Creating Network Sensor Policies and Signatures 2-3

Copying Existing Policies

Refer to page...
2-4
2-6
2-8
2-11
2-13
2-14
2-16
2-18