Intrusion Detection - Secure Computing SG300 User Manual

Note
Implementations of protocols such as H.323 can vary, so if you are experiencing
problems then you can try disabling the module.
Check Enable Connection Logging to log connections to the system log as they are
established and expire, however this may result in a lot of log messages if you have a
large or busy network.

Intrusion Detection

Note
The SG300, SG530, SG550, SG560, SG570 and SG630 provide Basic Instrusion
Detection and Blocking only.
The SG unit provides two intrusion detection systems (IDS): the lightweight and simple-
to-configure Basic Intrusion Detection and Blocking, and the industrial strength Advanced
Intrusion Detection and Prevention.
These two systems take quite different approaches. Basic Intrusion Detection offers a
number of dummy services to the outside world, which are monitored for connection
attempts. Clients attempting to connect to these dummy services can be blocked.
Advanced Intrusion Detection uses complex rulesets to detect known methods used by
intruders to circumvent network security measures, which it either blocks, or logs to a
remote database for analysis.
152
Firewall