Tuning Phase

[bklawson]

Couple general questions.

I am about 3 weeks into the tuning phase on my 4250XL sensor. We are monitoring the Email DMZ as well as the General Population network.

Are there any specific sig that are not on by "default" that any of you would recommend, I should turn on for these networks?

With relation to the IDS/IPS image for the 4250XL... does anyone know when it will be available? And what is your opinion of having a 2800 (www router) doing some IPS vs. adding another IPS appliance to the network to drop all the viruses and other unwanted traffic?

Thanks for you time.

[marcabal]

The release date for IPS v5.0 has not officially

been announced yet.

The main difference between the 2800 router with IPS functionality and a IDS Appliances (loaded with the IPS v5.0 software when available) is the number of variety of signatures that can be detected and prevented.

With the IPS v5.0 software on the Appliances both the Appliance and Router would be able to drop the packets causing the attacks. The differene is that the Router has limited memmory and can only support a smaller number of signatures that can be supported on the Appliance. In addition, not all of the signature engines have been ported to work in the Routers, while all signature engines will work in the Appliance allowing for detection of many different types of attacks.