[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: [ISSForum] RSKill Gateway configuration on Proventia



You should configure the mac address of any router o layer 3 system in
order to improve the RSKILL packets. So the first hop to reach target
and attacker is that gateway.


-----Original Message-----
From: issforum-bounces@xxxxxxx [mailto:issforum-bounces@xxxxxxx] On
Behalf Of Mustapha Huneyd
Sent: Tuesday, December 21, 2004 12:46 AM
To: issforum@xxxxxxx
Cc: support@xxxxxxx
Subject: [ISSForum] RSKill Gateway configuration on Proventia


What is the RSKill gateway that must be configured ob the Proventia A
series 
applicance? The RSKill Interface connects to a switch on a VLAN and
doesnot 
necessarily have a gateway.

Mustapha

Etisalat, Abu Dhabi

----- Original Message ----- 
From: "Mustapha Huneyd" <mhbengal@xxxxxxxxx>
To: <issforum@xxxxxxx>
Cc: <support@xxxxxxx>
Sent: Monday, October 18, 2004 1:08 PM
Subject: [ISSForum] RSKill for Multiple Monitoring segments on Proventia
"A"


> How does one implement RSKILL on multiple VLANS using a Provetia "A"
> series IDS. We have a Proventia 604 that monitors 3 different segments
but 
> has only ONE RSKILL Interface. All these projects need different
policies 
> (one with SMTP and others for HTTP) and must have RSKILL capabilities.
>
> Has any achieved this using just ONE RSKILL interface.
>
> regards
> Mustapha
> ----- Original Message -----
> From: "Duncanson, Robert" <robert.duncanson@xxxxxxxxxxxxx>
> To: "Jose Morales" <mavenusa@xxxxxxxxx>; <issforum@xxxxxxx>
> Sent: Friday, October 15, 2004 5:09 PM
> Subject: RE: [ISSForum] Site Protector tools
>
>
>> Jose,
>>
>> The only thing stored in the database is the audit trail, but not 
>> actual sessions. You might be able to query the audit trail like 
>> this:
>>
>> SELECT
>> ADT.AuditTrailID, ADT.AuditTime, ADT.Username, ADC.EventDesc, 
>> ADI.ParamName, ADI.ParamValue from AuditTrail as ADT
>> JOIN AuditInfo as ADI
>> on ADT.AuditTrailID = ADI.AuditTrailID
>> JOIN AuditEventCMD as ADC
>> on ADT.AuditEventCMDID = ADC.AuditEventCMDID
>> -- AuditEventCMDID 5 = console login, 6 = console logout
>> WHERE ADT.AuditEventCMDID IN (5, 6)
>>
>>
>> Cheers,
>> Robert
>
> _______________________________________________
> ISSForum mailing list
> ISSForum@xxxxxxx
>
> TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
> https://atla-mm1.iss.net/mailman/listinfo/issforum
>
> To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx
>
> The ISSForum mailing list is hosted and managed by Internet Security
> Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328. 

_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx

The ISSForum mailing list is hosted and managed by Internet Security
Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.

_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx

The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.