NETGEAR UTM50-100NAS, UTM5-100NAS manual V1.0, January

ProSecure Unified Threat Management (UTM) Appliance Reference Manual

Note: Traffic that passes on the UTM’s VLANs and on the secondary IP addresses that you have configured on the LAN Multi-homing screen (see “Configuring Multi- Home LAN IPs on the Default VLAN” on page 4-11) is also scanned by the IPS.

When you enable the IPS, the default IPS configuration goes into effect. The default IPS configuration is the configuration that the Advanced (IPS) screen returns to when you click the Reset button. To modify the default IPS configuration:

1.Select Network Security > IPS from the menu. The IPS submenu tabs appear, with the Global (IPS) screen in view (see Figure 5-30 on page 5-49).

2.From the IPS submenu tabs, click Advanced. The Advanced (IPS) screen displays see Figure 5-31 on page 5-51). This screen displays sections for the different categories of attacks such as Web, Mail, Databases, and so on.

3.In the Enabled column for each section, either select individual attacks by selecting the checkboxes to the left of the names, or select all attacks for that category by selecting the checkbox to the left of “All web attacks.”

4.In the Action column for each section, either select the actions for individual attacks by making selections from the pull-down menus to the right of the names, or select a global action for all attacks for that category by making a selection from the pull-down menu to the right of “All web attacks.” Some of the less familiar Web and miscellaneous attacks are explained in Table 5-11 on page 5-52.

The pull-down menus let you make one of the following actions:

•Alert. When an attack occurs, an alert is logged but the traffic that carries the attack is not dropped.

•Drop. The traffic that carries the attack is dropped and an alert is logged.

Note: To ensure that alerts are emailed to an administrator, you must configure the e-mail notification server (see “Configuring the E-mail Notification Server” on page 11-5) and the IPS alerts (see “Configuring and Activating Update Failure and Attack Alerts” on page 11-10).

5.Click Apply to save your settings.

5-50 Firewall Protection

v1.0, January 2010