Administering Network IPS appliances

Administering the Network IPS appliance involves working with features of the appliance that you use regularly. For example, some features that you use regularly might include working with connection events and tuning parameters, managing licenses, and capturing network packets.

Backing up the Network IPS appliance settings
Use this method to back up a working version of your Network IPS appliance settings by using either Secure Shell (SSH) or a serial console connection.
Restoring firmware from a backup
Use this method to restore the Network IPS appliance firmware by using either Secure Shell (SSH) or a serial console connection.
Network IPS Local Management Interface
The Network IPS Local Management Interface is a browser-based graphical user interface for local, single appliance management.
SiteProtector Management
You use the SiteProtector™ system to manage the Network IPS appliance. With the SiteProtector system, you can create, manage, and view your current Network IPS policies.
Reverting to the default security events policy
For Network IPS appliances, revert to the default security events policy by grouping with the User Overridden option.
About protection domains
For Network IPS appliances, use protection domains to define security or user-defined policies for different network segments that are monitored by a single appliance. Protection domains act like virtual sensors, as though you had several appliances monitoring the network. You can define protection domains by interfaces, VLans, or IP addresses.
How connection events work
For Network IPS appliances, connection events occur when network traffic connects to the monitored network through a particular port, from a particular address, with a certain network protocol.
About removing connection events
For Network IPS appliances, you can remove any connection event from the list. However, if you edit a predefined connection event and decide to remove it, the event is not returned to its predefined state. Instead, the event is removed from the list entirely.
About tuning parameters
For Network IPS appliances, tuning parameters affect intrusion prevention settings at the group and site levels.
PAM
The Protocol Analysis Module (PAM) provides the information that the Network IPS appliance uses to protect the network against intrusions.
PAM-controlled security events and response filters
The Protocol Analysis Module (PAM) controls X-Force® Virtual Patch® recommendations, which means that PAM controls many security events. PAM overrides settings that are configured for some security events in the Web Application Protection (WAP) policy. Use response filters to override PAM settings.
SNORT and PAM
For Network IPS appliances, SNORT and PAM (Protocol Analysis Module) analyze the same data packets independently. Because of this design, unexpected behavior is possible from each system.
The SnEP
For Network IPS appliances, the SNORT event processor (SnEP) scrapes errors from the SNORT system and sends them to a control and response module. The module interprets the errors as significant events, log messages, and SiteProtector system alerts.
SNORT and HA mode
For Network IPS appliances, choose the appropriate behavior to decide whether to enable or disable the Inspect HA mirrored ports check box on the SNORT Configuration tab.
SNORT and quarantine functions
For Network IPS appliances, configure quarantine rules and send quarantine responses for events that are generated from suspicious activity that is identified by the integrated SNORT system.
About imported SNORT rules
The Network IPS appliance imports and manages SNORT rules from a rules file that uses customized settings and programmed behavior.
About deleting SNORT rules
The Network IPS appliance does not keep a record of past and deleted rules. If you delete a rule, and then reimport a rules file that contains the deleted rule, the appliance adds the rule back into the SNORT policy.
About SNMP
Simple network management protocol (SNMP) is used for managing networks. SNMP-compliant devices, called agents, store data about themselves in management information bases (MIBs) and return this data to SNMP management applications.
About the MIB file
For Network IPS appliances, import or compile the MIB (Management Information Base) file to display the IBM® Security-assigned event name in SNMP trap messages.
Using executable routines or shell scripts
For Network IPS appliances, use a Linux binary file or shell script file in an executable routine for user-specified responses.
About the block response
For Network IPS appliances, the block response is a default response that blocks attacks by dropping packets and sending resets to TCP connections.
About the ignore response
For Network IPS appliances, set the ignore response to configure the appliance to disregard packets that match criteria that are specified within a security event or a response filter.
Response filters and data loss prevention signatures
When you configure a response filter in the Network IPS Local Management Interface for a data loss prevention (DLP) user-combined or user-defined event, you see different signatures than the ones in the DLP lists.
About log evidence
The Network IPS appliance uses log evidence, along with the rolling packet capture feature, to gather evidence about suspicious events.
About rolling packet capture
The Network IPS appliance uses rolling packet capture, along with the log evidence feature, to gather evidence about suspicious events.
Firewall rule order
Use the Firewall Rules page for the Network IPS appliance to order your firewall rules. The appliance reads the list from top to bottom in the order they are listed and applies configured actions.
High availability overview
Two Network IPS appliances mirror traffic in an existing high availability network environment with high availability (HA) mode.
About authentication servers and remote users
For Network IPS appliances, the Remote Users list does not recognize whether users authenticate with a Radius, LDAP, or an Active Directory server. As you enter users, make note of which authentication servers their information exists.
Resetting and unlocking user accounts
For Network IPS appliances, the root user can reset and unlock accounts by using the passwd and faillog commands.
Restart and shut down
When you restart or shut down the Network IPS appliance, the appliance goes offline for several minutes and can make the network vulnerable.
Managing updates and licensing
Use the Update and Licensing page for the Network IPS appliance to determine whether the appliance is up-to-date with the latest firmware and intrusion prevention updates. This page also lists any updates that you have installed on the appliance.
Reviewing logs
Use the Logs area of the Network IPS appliance to view system, firewall, and security alert logs. You can filter these lists by specific keywords and network characteristics and save your searches for future use.
Using diagnostics
Use the Analysis and Diagnostics area of the Network IPS appliance to test communications, trace IP packets, and manage SNORT rule profiling files.
Logs and packet captures
You can view and download log files and packet captures that are associated with the Network IPS appliance and translate log file timestamps.
Implementing FIPS on Network IPS appliances
This section describes how to restore an appliance to factory defaults and explains how to enable FIPS mode on your appliance.