Configure Intrusion Prevention
To use Intrusion Prevention Service (IPS), you must have a feature key to enable the service.
For more information, see:
Enable IPS and Configure IPS Actions
To enable IPS:
- Select Subscription Services > IPS.
The IPS page appears.
- Select the Enable Intrusion Prevention check box.
- Select the Scan Mode. You can select one of two modes:
- Full Scan — Scan all packets for policies that have IPS enabled.
- Fast Scan — Scan fewer packets to improve performance. This option greatly improves the throughput for scanned traffic, but does not provide the comprehensive coverage of Full Scan mode. This is the default setting.
If you have a WatchGuard XTM 21, 22, or 23 device, this feature is not available for your device.
- For each threat level, select the action. Available actions are:
- Allow — Allows the connection.
- Drop — Denies the request and drops the connection. No information is sent to the source of the content.
- Block — Denies the request, drops the connection, and adds the IP address of the content source to the Blocked Sites list. If the content that matches an IPS signature came from a client, the client IP address is added to the Blocked Sites list. If the content came from a server, the server IP address is added to the Blocked Sites list.
- For each threat level, to send a log message for an IPS action, select the Log check box.
- For each threat level, to trigger an alarm for an IPS action, select the Alarm check box.
- Click Save.
If you enable IPS for an HTTPS proxy policy, you must also enable deep inspection of HTTPS content in the HTTPS proxy action, in order for IPS to scan the HTTPS content. For more information, see HTTPS-Proxy: Content Inspection. IPS scanning of HTTPS content is not supported on XTM 21, 22, and 23 devices.
Configure Other IPS Settings
In the IPS Policies section, you can disable or enable IPS for each policy in your configuration. For more information, see Disable or Enable IPS for a Policy.
To configure signature update settings, select the Update Server tab. For more information, see Configure the IPS Update Server.
To add signatures to the exceptions list, select the Signatures tab. For more information, see Configure IPS Exceptions.