SonicWALL Anti-Spyware Administrator's Guide

Inbound and Outbound Protection
SonicWALL Gateway Anti-Virus, Anti-Spyware and Intrusion Service are applied to both inbound and
outbound traffic, because signatures are written directionally. That is, the direction of the attack is
considered when applying protection on a SonicWALL security appliance.
For example, the Sasser worm. SonicWALL signatures were written to examine different stages and
directions of this complex attack. One signature looked for a NetBIOS buffer overflow attack that uses the
common NetBIOS ports as an exploit. This SonicWALL signature is applied inbound between zones
(SonicOS Enhanced) and interfaces (SonicOS Standard) from the Internet, effectively stopping the
proliferation of the exploit from the external network. After the initial exploit, the Sasser worm attempts to
download the main part of its program through an FTP session out to the Internet.
Another SonicWALL signature automatically prevents Sasser from establishing an outbound FTP session
to the Internet, and it may be applied to each zone or interface.
SonicWALL Gateway Anti-Virus, Anti-Spyware and Instrusion Prevention Service does not require you to
understand what signatures are applied in what directions. You simply select predefined groups based on
the severity of the attacks or the danger level of the spyware.
Disabling the SonicWALL Gateway Anti-Virus, Anti-Spyware
and Intrusion Prevention Engine
In the unlikely event that SonicWALL Gateway Anti-Virus, Anti-Spyware and Intrusion Prevention Service
are not enabled on your SonicWALL security appliance, you can disable the SonicWALL Gateway Anti-
Virus, Anti-Spyware, and Intrusion Prevention Service engine to reallocate resources to the SPI (Security
Parameter Index) connection cache.
To disable the SonicWALL Gateway Anti-Virus, Anti-Spyware, and Intrusion Prevention Service engine:
1. Select the Firewall > Advanced page.
2. Select the Disable Anti-Spyware, Gateway AV and IPS Engine (increases maximum SPI
connections) checkbox. An alert is displayed informing you that the SonicWALL security appliance
must be rebooted for the change to take effect.
3. Restart your SonicWALL security appliance.
Page 11