Intrusion Prevention Service Policies

This section allows the administrator to configure settings for individual attacks.

1. Locate the type of attack that you would like to view. To sort by category, select a category from the Categories list. To sort by priority, select a priority level from the Priority list.
2. After locating a type of attack to configure, click Config/Edit on its row. A dialog box appears where you can give specific information about the IPS Signature Settings for the selected attack. The top part of the dialog box is populated with the information from the selected Signature row.

3. Configure the fields in the dialog box for each type of attack you need to edit:

   • Signature Category- Displays the signatures organized within categories.

   • Signature Name- Displays the signatures in that category.

   • Signature ID- Displays the signature individual category ID.

   • Priority- Displays the global attack priority level.

   • Direction- Displays the direction of port forwarding to server.

   • Prevention - Select whether attack prevention for this type of attack is enabled, disabled, or uses the default global settings for the attack category from the list.
   • Detection - Select whether attack detection for this type of attack is enabled, disabled, or uses the default global settings for the attack category from the list.
   • Included Users/Groups - Select which users or groups to include for this attack type from the list.
   • Excluded Users/Groups - Select which users or groups to exclude for this attack type from the list.
   • Included IP Address Range - Select an IP address range to include for this attack type from the list.
   • Excluded IP Address Range - Select an IP address range to exclude for this attack type in the list box.
   • Schedule - Select a time range to enforce attack protection on this attack type the list.
   • Log Redundancy Filter (seconds) - Enter a time span (in seconds) to set the filter or select Use Category Settings.

   Signatures categorized for stack traffic inspection (self-scan signatures) are managed automatically by SonicWall's security research team and are not configurable through the IPS Policies interface. These signatures apply globally when the feature is active.

4. Save - This selection returns you to the Intrusion Prevention page. Your changes have been applied.
5. Cancel - This selection discards your changes.