About Intrusion Prevention Service
Intrusion Prevention Service (IPS) provides real-time protection from threats, including spyware, SQL injections, cross-site scripting, and buffer overflows. When a new attack is identified, the features that make the intrusion attack unique are recorded. These recorded features are known as the signature. IPS uses these signatures to identify intrusion attacks.
By default, when you enable and configure IPS, the IPS configuration applies globally to all traffic. You can also choose to disable IPS on a per-policy basis.
Add the IPS Upgrade
To enable IPS, you must:
Keep IPS Signatures Updated
New intrusion threats appear on the Internet frequently. To make sure that IPS gives you the best protection, you must update the signatures frequently. You can configure the Firebox to update the signatures automatically from WatchGuard, as described in Configure the IPS Update Server.
IPS and Application Control signature updates are delivered together in the same update file. The size of the IPS signature set depends on your Firebox hardware platform and software version. For more information, see IPS and Application Control Signature Set Sizes.
See IPS Status
To see statistics on current IPS activity and update the IPS signatures, from Firebox System Manager. For more information, see Application Control and Intrusion Prevention Service Statistics.