18.07.2013 Views

Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

<strong>Sidewinder</strong> <strong>G2</strong><br />

SNMP traps<br />

Chapter 20: IPS Attack and System Event Responses<br />

<strong>Sidewinder</strong> <strong>G2</strong> SNMP traps<br />

To ignore network probes (commonly referred to netprobes), you can create IP<br />

Filter rules to deny connection requests for specific ports. For example, if you<br />

have problems with netbios generating netprobes on the <strong>Sidewinder</strong> <strong>G2</strong>, you<br />

can discard them and prevent audit events by creating an IP Filter with the<br />

following key values:<br />

Type: UDP Audit Level: None<br />

Action: Deny Direction: Uni-directional<br />

Source/Dest Burbs: internal Source/Dest: All (subnet 0.0.0.0:0)<br />

Source/Dest Ports: 137<br />

The <strong>Sidewinder</strong> <strong>G2</strong> can cause network probe attempts between services<br />

running on the system. These probe attempts usually indicate one <strong>of</strong> the<br />

services is responding slowly, and do not show that a problem exists on the<br />

<strong>Sidewinder</strong> <strong>G2</strong>. By default, auditing these loopback network probes is<br />

disabled. To turn on auditing for the network probe attempts between services<br />

running on the system, enter the following command in the admin role:<br />

sysctl -w kern.audit_netprobe_loopback=1<br />

Note: If you want to ensure that this remains configured, you should also add this<br />

command to the end <strong>of</strong> the /etc/rc.local file.<br />

An SNMP trap is an alert message (also known as an alarm message) that is<br />

sent as an unsolicited transmission <strong>of</strong> information from a managed node<br />

(router, <strong>Sidewinder</strong> <strong>G2</strong>, etc.) to a management station. <strong>Sidewinder</strong> <strong>G2</strong> gives<br />

you the option <strong>of</strong> sending audit alert SNMP traps when an audit event triggers<br />

a response in <strong>Sidewinder</strong> <strong>G2</strong>. Pre-defined alert events in <strong>Sidewinder</strong> <strong>G2</strong> are<br />

contained in the 200 range (for example, 201, 202). You also have the option to<br />

create your own custom traps. Custom traps will return messages that contain<br />

numbers 215–225. For a list <strong>of</strong> available SNMP traps, see the snmptrap man<br />

page.<br />

To configure <strong>Sidewinder</strong> <strong>G2</strong> to send the following pre-defined traps, refer to<br />

“About the Modify Attack Response: Response tab” on page 569 and “About<br />

the Modify System Response: Response tab” on page 576.<br />

• ATTACK_ATTEMPT — This trap is sent when an attack attempt (that is, any<br />

suspicious occurrence) is identified by one <strong>of</strong> the services on <strong>Sidewinder</strong><br />

<strong>G2</strong>. For example, if the Network Services Sentry (NSS) detects a<br />

suspicious IP address on an incoming connection, it will issue an attack<br />

attempt trap.<br />

• FAILOVER_EVENT — This trap is sent any time a <strong>Sidewinder</strong> <strong>G2</strong> changes<br />

its status in an HA cluster from secondary to primary, or from primary to<br />

secondary.<br />

579

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!