Intrusion Defense Firewall 1.2 User's Guide - Trend Micro? Online ...

More documents

Recommendations

Info

Information IP Don't Fragment bit was set. The "MF" field is present if the IP More Fragments bit was set. The "FRAG=nnn" field contains the fragment offset value. Protocol The "PROTO=" field contains the name of the protocol, or its numeric format (in decimal) if it's not one of the well known values. Ports The "SPT=" and "DPT=" fields contains source and destination ports, if applicable to the protocol type. TCP Flags For the TCP protocol, the URG, ACK, PSH, RST, SYN, FIN fields are present if the corresponding TCP header bit was set. The "RES=0xNN" field is always present and contains the value of the reserved TCP bits. The ECN flags "CWR" and "ECE" will show up in the two least significant bits of this field. ICMP Flags For the ICMP protocol, the "TYPE=N" field contains the ICMP type (in decimal) and the "CODE=N" field contains the ICMP code (in decimal). IP Datagram Length The "IPDGLEN=N" field contains the length of the IP datagram in decimal format. DPI Event Log Format MF FRAG=22 PROTO=TCP PROTO=UDP PROTO=ICMP SPT=137 DPT=137 SPT=41794 DPT=3328 RES=0x00 ACK RES=0x00 SYN ACK TYPE=11 CODE=0 TYPE=8 CODE=0 IPDGLEN=0 IPDGLEN=60 As with the Firewall Rule syslog format, the Client Plug-in follows the format used by netfilter/iptables as closely as possible, and adds several Trend Micro specific fields. Fields are delimited by a single space character, and consist of a TOKEN or a TOKEN=value string. The value string will never contain space characters. In the case of items such as rule names or network interface names, space characters are converted to underscores. Name Description Examples Reason The "REASON=" field contains either a built-in string or the string "PLD:" followed by the name of the DPI Rule that caused the log. Space characters in the DPI Rule name are converted to underscores. Direction The direction of the data flow. FWD REV REASON=PLD:Log_HTTP_GET_commands REASON=URI_Path_Length_Too_Long © Copyright 2010 Trend Micro Inc. www.trendmicro.com All rights reserved. - 90 -
Interface Information IP Information Interface name and Ethernet frame information. The IN=, OUT=, and MAC= fields are always present. Unlike the Firewall Event logs, the DPI Event logging doesn't log packets on an incoming/outgoing basis, but based on their connection flow direction (FWD or REV). In order to stick with netfilter/iptables interface logging conventions, the Client Plug-in looks at the DPI Rule definition. If the DPI Rule is an incoming rule the interface name follows IN=, and the OUT= field contains nothing. The opposite is true for outgoing DPI Rules. The MAC= field consists of 14 twodigit hex characters. The first six are the destination MAC address, the next six are the source MAC address, and the last two are the Ethernet frame type. The source and destination IPs in numeric form. Protocol The "PROTO=" field contains the name of the protocol, or its numeric format (in decimal) if it's not one of the well known values. Ports The "SPT=" and "DPT=" fields contains source and destination ports, if applicable to the protocol type. TCP Flags For the TCP protocol, the URG, ACK, PSH, RST, SYN, FIN fields are present if the corresponding TCP header bit was set. The "RES=0xNN" field is always present and contains the value of the reserved TCP bits. The ECN flags "CWR" and "ECE" will show up in the two least significant bits of this field. ICMP Flags For the ICMP protocol, the "TYPE=N" field contains the ICMP type (in decimal) and the "CODE=N" field contains the ICMP code (in decimal). IP Datagram Length The "IPDGLEN=N" field contains the length of the IP datagram in decimal format. Action The "ACTION" field contains the action taken by the DPI Rule. It contains one of the strings "Block", "Reset", "Insert", "Delete", "Replace", "Log". If the rule or the DPI engine is operating in detectonly mode, the action value will be preceded by "IDS:". IN=LAN_-_Gigabit OUT= MAC=FF:FF:FF:FF:FF:FF:00:80:C8:38:79:E3:08:00 IN= OUT=eth2 MAC=00:11:95:B9:A5:AD:00:11:95:B9:A5:B4:08:00 SRC=192.168.5.9 DST=192.168.5.255 SRC=192.168.5.8 DST=192.168.5.255 PROTO=TCP PROTO=UDP PROTO=ICMP SPT=137 DPT=137 SPT=41794 DPT=3328 RES=0x00 ACK RES=0x00 SYN ACK TYPE=11 CODE=0 TYPE=8 CODE=0 IPDGLEN=0 IPDGLEN=60 ACTION=Log ACTION=IDS:Block © Copyright 2010 Trend Micro Inc. www.trendmicro.com All rights reserved. - 91 -
Page 1 and 2:
Intrusion Defense Firewall 1.2 for
Page 3 and 4:
Table Of Contents Introduction ....
Page 5 and 6:
Introduction © Copyright 2010 Tren
Page 7 and 8:
DPI (Deep Packet Inspection) Rules
Page 9 and 10:
Server Plug-in Interface © Copyrig
Page 11 and 12:
Task Pane Clicking an element in th
Page 13 and 14:
Shortcut Menus Many of the IDF Serv
Page 15 and 16:
Click Add/Remove Widgets... at the
Page 17 and 18:
Reports IDF Server Plug-in produces
Page 19 and 20:
Note that if you apply other settin
Page 21 and 22:
The Computer's status will be displ
Page 23 and 24:
Computer Details The Computer's Det
Page 25 and 26:
Alerts Alerts are displayed the sam
Page 27 and 28:
Security Profiles Security Profiles
Page 29 and 30:
Firewall (Events, Rules, and Statef
Page 31 and 32:
Firewall The information box will t
Page 33 and 34:
Interface: The MAC address of the i
Page 35 and 36:
Firewall Rules Firewall Rules exami
Page 37 and 38:
Options Alert Select whether or not
Page 39 and 40:
TCP The Firewall Rule engine, by de
Page 41 and 42:
The ICMP (pseudo-)stateful mechanis
Page 43 and 44: DPI Events By default, the IDF Serv
Page 45 and 46: DPI Rules Whereas Firewall Rules an
Page 47 and 48: you which rule on which Computer(s)
Page 49 and 50: Components IP Lists Reusable lists
Page 51 and 52: MAC Lists Use the MAC Lists section
Page 53 and 54: Contexts Contexts are a powerful wa
Page 55 and 56: Schedules Schedules are used by var
Page 57 and 58: System Events The System Event log
Page 59 and 60: System Settings The System > System
Page 61 and 62: example, your network has no DNS an
Page 63 and 64: Firewall and DPI Network Engine Mod
Page 65 and 66: ESTABLISHED Timeout: How long to st
Page 67 and 68: Interface Isolation Interface Isola
Page 69 and 70: Analysis The Analysis screen allows
Page 71 and 72: Notifications Alert Notification (f
Page 73 and 74: System Alert Configuration View Ale
Page 75 and 76: Backup Perform regular database bac
Page 77 and 78: Updates Security Updates Security U
Page 79 and 80: How To... Customize the Dashboard H
Page 81 and 82: Configure Alerts There are just ove
Page 83 and 84: 3. In the "Direction of IDF Server
Page 85 and 86: Set Up Email Alerts IDF Server Plug
Page 87 and 88: 3. Start the " Intrusion Defense Fi
Page 89 and 90: Configure Logging By default, IDF S
Page 91 and 92: Configure Port Scan Settings The ID
Page 93: click it to view its Details window
Page 97 and 98: System Event Log Format System Even
Page 99 and 100: Backup and Restore IDF Intrusion De
Page 101 and 102: CALL sqlcmd -S localhost\IDF -E -v
Page 103 and 104: Upgrade the Server Plug-in The Offi
Page 105 and 106: Manually Uninstall a Client Plug-in
Page 107 and 108: #Wed Jun 11 16:19:19 EDT 2008 datab
Page 109 and 110: Migrate a Single Managed Computer t
Page 111 and 112: counter3s counter3ports counter3ips
Page 113 and 114: Reference © Copyright 2010 Trend M
Page 115 and 116: managed Computer and the wizard wou
Page 117 and 118: The Inherit checkbox determines whe
Page 119 and 120: 4. In the Properties window, click
Page 121 and 122: 8. The final step in the Firewall s
Page 123 and 124: Click OK when you're done. Apply th
Page 125 and 126: Firewall IP Activity (Prevented) Fi
Page 127 and 128: The FORCE ALLOW rule can be placed
Page 129 and 130: 1. First enable stateful inspection
Page 131 and 132: Tap Mode IPv6 Packet Max Incoming C
Page 133 and 134: 3602 Windows Service Error 3603 Fil
Page 135 and 136: Creating and Applying New Firewall
Page 137 and 138: Creating Custom DPI Rules Trend Mic
Page 139 and 140: Memory Allocation Error Out Of Orde
Page 141 and 142: Firewall Events CE Flags Event Note
Page 143 and 144: Inheritance and Overrides Settings
Page 145 and 146:
In the Properties window for this F
Page 147 and 148:
Required Ports A number of ports mu
Page 149 and 150:
Firewall Rule Sequence Packets arri
Page 151 and 152:
191 Alert Changed 192 Alert Ended 1
Page 153 and 154:
473 DPI Rule Exported 474 DPI Rule
Page 155 and 156:
726 Get Client Plug-in Events Faile
Page 157:
Privacy Policy Trend Micro, Inc. is
show all

Intrusion Defense Firewall 1.2 User's Guide - Trend Micro? Online ...

Create successful ePaper yourself

Delete template?

Save as template?