[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: [ISSForum] ISS SiteProtector and the Proventia A604 appliancequestions



Harland,

>1)      I am going to relocate a Proventia appliance to a new customer
and 
>provide them access to the box. I do not want them to be able to view
old 
>log files or policies on the appliance. How can I delete old policy 
>configurations and log files using the CLI on the box?

I would choose to perform a clean reinstall from the distribution CD,
which overwrites the old partition. I can't think of any drawback,
except perhaps reapplying XPU's which is very minor indeed.

>2)      I have configured a response policy with a SNMP trap
destination 
>and mail server. I am able to receive traps and mails when attacks or 
>audit events occur. How do I configure the SiteProtector so that the 
>appliance sends a trap and a mail when a new policy is installed on the

>appliance?

Policy installation alerts don't come from the policy-based configurable
events, so you can't give them special treatment. Instead you can enable
SNMP for Sensor Low/Medium/High events (this is done from Sensor
Properties, not the policy)) which will do so for all internal events -
including policy install messages - and ignore/filter out uninteresting
messages on the trap receiver. 

>4)      Is it possible to view in the SiteProtector how many packets
that 
>have been dropped by the Proventia appliance?

Try the following parameters. (Note, I have only used this on the IPSO
platform and it may not have any effect on Proventia.)

Name driver.droppedpacketnotifyenabled
Type: Boolean
Value: True/False
Description:Determines whether dropped packet notification is enabled.

Name driver.droppedpacketinterval
Type: number
Value: xxxx
Description: Specifies the elapsed number of seconds that must pass
before a dropped packet notification is generated. The timer is started
only after the first dropped packet is found.

Name pam.statistics.interval
Type: number
Value: xxxx
Description: Number of seconds between reporting sensor statistics

As far as I can remember you'll find the # of dropped packets as an
attribute of the SensorStatistics and SensorStatistics_Cumulative
events. One oddity I noticed a few months back is that if there are no
packets at all, the SensorStatistics event will not fire even though an
interval has been configured. Apart from that, the event is generated
regularly under all traffic conditions. 

Cheers,
RObert

_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx

The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.