Enabling Advanced Protection Settings; Ip Spoofing Protection - Symantec 360R - Security Gateway SGS Administration Manual

Enabling advanced protection settings

IP spoofing protection

Block/Don't Warn
■
Drop the packet; but do not log.
You can configure the following options for enabling and disabling IDS/IPS
signature detection and logging:
Select All to enable or disable detection of ALL signatures.
■
Enable/disable detection of each signature individually.
■
To set protection preferences
See "IDS Protection tab field descriptions"
1 In the SGMI, in the left pane, click IDS/IPS.
2 In the right pane, on the IDS Protection tab, under IDS Signatures, from the
Name drop-down list, select an IDS signature.
To apply the preferences to all the signatures, click >>Select All<<.
3 Under Protection settings, next to Action, select an action.
4 Next to Protection Area, select an interface to protect.
5 Click Update.
Advanced protection settings help you protect your network beyond attacks that
can be identified by atomic signatures.
Any non-broadcast or multicast packet arriving on a WAN interface with a
source IP address that matches any internal subnet is blocked and flagged as an
IP spoofing attempt. Internal subnets are derived from the LAN side subnet
address of the appliance and the static route entries on the appliance for the
LAN interface.
Likewise, any non-broadcast or non-multicast traffic that arrives at the internal
or wireless interface with a source IP address that does not match any
predefined internal network is blocked and logged as an internal IP spoofing
attempt. Internal networks are derived from static routes on the unit and the
internal LAN/WLAN address of the unit. Spoof protection can be disabled for the
internal LANs and WAN.
To configure IP spoof protection
See "IDS Protection tab field descriptions"
Preventing attacks
Enabling advanced protection settings
on page 205.
on page 205.
117