Intrusion Prevention and 9.0

[dmorris]

We made several performance improvements and overall cleanups to the product in 9.0, especially to "matchers" which match rules/strings to port, address, usernames, etc. This isn't a change to Intrusion Prevention specifically, but it does effect Intrusion Prevention heavily along with other rule-based apps like Firewall, Policy Manager, etc.

This has really improved the performance of Intrusion Prevention so as a result you might notice that it is matching a lot more traffic and signatures than it did in previous versions.
This is an unfortunate side effect for these improvements. Why "unfortunate?"
Because many users have never run an intrusion prevention system before and may not be prepared for the level of effort required to run an intrusion prevention system.

Here is my personal thoughts about running Intrusion Prevention in Untangle:
* There will be false positives, often thousands of them. You can ignore them or disable the rules you don't want to hear about. This is the nature of IPS.
* Intrusion Prevention plays just a small role within Untangle and within most organizations overall security landscape.
* Keeping a Intrusion Prevention system running can be a lot of work.
* The amount of security gained from Intrusion Prevention is debatable.
* Given, the above points in most networks it may make sense to NOT enable Intrusion Prevention as the gain is minimal but the effort is real. If you aren't prepared to deal with Intrusion Prevention I would suggest you NOT run Intrusion Prevention.

Hopefully this will help explain some of the things people are seeing in 9.0

[bigdessert]

to me this is great news!

[f1assistance]

I second that!
Whining about what I should have deployed in this environment seems way more costly...plus, we've all been there, done that!
Besides, HOPE is not a security strategy.

[adrianp918]

is there a list of what the corresponding codes mean...for novice people?

[adrianp918]

never mind i found it i believe in the logs and description its self

[sky-knight]

So the official position is that this thing is now as annoying as a block by default firewall?

I need to upgrade.

[fasttech]

Originally Posted by sky-knight

So the official position is that this thing is now as annoying as a block by default firewall?

Or, perhaps it's something along the lines of, 'Now, it actually works.'.

[sky-knight]

True, that module has always been really quiet. I'm going to have to disable it in my field units until I can get a feel for the updated functionality.

[dmorris]

Maybe I'm the only one not looking forward to the flood of calls and posts saying "OMG I've been ATTACKED!!!11"

[fasttech]

Let's just say, out of many, varied installations over the years, this is the only ips system that I didn't have to tune. Look forward to the change.