Configure Intrusion Prevention

To use Intrusion Prevention Service (IPS), you must have a feature key to enable the service. For more information, go to:

IPS Scan Modes

IPS has two scan modes

  • Full Scan — Scan all packets for policies that have IPS enabled.
  • Fast Scan — Scan fewer packets within each connection to improve performance.

Full scan mode inspects a larger portion of the file and requires more time and resources to complete. Fast scan mode inspects a smaller portion of each file that in most cases is enough to identify all threats, and provides much better IPS performance. WatchGuard recommends you use the Full scan mode in most environments.

IPS Threat Levels

IPS categorizes IPS signatures into five threat levels, based on the severity of the threat. The severity levels, from highest to lowest are:

  • Critical
  • High
  • Medium
  • Low
  • Information

When you enable IPS, the default setting is to drop and log traffic that matches the Critical, High, Medium, or Low threat levels. Traffic that matches the Information threat level is allowed and not logged by default.

IPS Actions

For each threat level you can select one of these actions:

  • Allow — Allows the connection.
  • Drop — Denies the request and drops the connection. No information is sent to the source of the content.
  • Block — Denies the request, drops the connection, and adds the IP address of the content source to the Blocked Sites list. If the content that matches an IPS signature came from a client, the client IP address is added to the Blocked Sites list. If the content came from a server, the server IP address is added to the Blocked Sites list.

Enable and Configure IPS

If your Firebox has an active IPS subscription, the Web Setup Wizard and Quick Setup Wizard automatically enable IPS with recommended settings. For more information, go to Setup Wizard Default Policies and Settings.

If IPS was not automatically enabled, you can enable it in Fireware Web UI or Policy Manager.

When you enable IPS, a warning message appears if automatic updates are disabled for IPS signatures. To configure automatic updates, go to Configure the IPS Update Server.

If you enable IPS for an HTTPS-proxy policy, you must also enable Content Inspection in the HTTPS-proxy action, in order for IPS to scan the HTTPS content. For more information, go to HTTPS-Proxy: Content Inspection.

Configure Other IPS Settings

To keep your signatures current, make sure that you enable automatic updates of IPS signatures.

Related Topics

Video tutorial: Getting Started with IPS