Polycom 3725-77601-001H manual Network Intrusion Detection in Maximum Security Mode

Polycom CMA System Operations Guide

To restore a system from a backup archive

1Restore the system to its factory default configuration. You will need the Restore to Factory Default DVD that shipped with the CMA system server. This DVD has the base image of the CMA system server software.

WARNING

•This is a last resort, so never do this without being instructed to do so by PGS support.

•This process will wipe out your system database and all other system data.

•The Restore to Factory Default DVD is specific to the CMA system server type and version.

2Perform First Time Setup. For more information about First Time Setup, see the Polycom CMA System Getting Started Guide for this release.

3Restore the system configuration using the last archived configuration. The archived configuration will overwrite the configuration that resulted from First Time Setup. The only CMA system configuration settings not included in the archive and thus not overwritten are the network settings and the security certificates required for an operational system.

In cases when the CMA system is functional, but the configuration or database is corrupted, the backup archive can also be used to return a CMA system back to its last known good archive. As long as the network settings and security certificates are operational, the last known good archive will return the CMA system to its former functional state.

Network Intrusion Detection in Maximum Security Mode

The CMA system detects network intrusions by processing the Microsoft Windows Firewall logs, inserting dropped packet information into a temporary system database table, and identifying certain patterns in the data.

The CMA system detects the following types of instrusions: a fast port scan, a slow port scan, a denial of service (DoS) attack, and a flood attack. These are currently defined as:

•Fast port scan:

10 connections in a 5-second time period from the same source IP.

•Slow port scan:

100 connections in a 1-hour time period from the same source IP.

•DoS attack:

100 connections in a 5-second time period to the same destination port.

•Flood attack:

100 connections in a 5-minute window to any destination port from any source IP.

34 Polycom, Inc.