Seitenhistorie

...

The feature Intruder Detection System / Intruder Prevention System (IDS/IPS) recognizes and blocks potentially malicious packets. Although it is possible that normal traffic is recognized as potentially malicious and is therefore blocked.

This article describes how an exception for the feature IDS/IPS can be created.

Requirements:

• LANCOM R&S®Unified Firewall mit LCOS FX ab Version  with firmware version 10.3
  
• Eingerichtetes und funktionsfähiges Netzwerk samt Internetzugang auf dem LANCOM Router
•  or later
• A configured and functional local network and Internet connection on the Unified Firewall
• Web browser for configuring the Unified Firewall
  
  The following browsers are supportedWeb-Browser zur Konfiguration der Unified Firewall.
  Es werden folgende Browser unterstützt:
  • Google Chrome
  • Chromium
  • Mozilla Firefox

Procedure:

1) Creating an exception for the feature IDS/IPS: 

1.1) Open the configuration of the Unified Firewall in a browser and go to the menu Monitoring & Statistics → Settings.

Image Modified

1.2) In the dropdown-menu IDPS Alert select the option Save Raw Data Locally in order for the Unified Firewall to log packets which are recognized and blocked by IDS/IPS.

Afterwards click SaveClick Save afterwards.

Image Modified

1.3) Go to the menu Monitoring & Statistics → Logs → Alert Log.

Image Modified

1.4) In the field More Filters select the parameter Category: IDPS  to  to limit the Alert Log to IDS/IPS messages.

Image Modified

1.5) Select an event you want to allow, click on the "Gear gear symbol" and afterwards on Ignore RuleRule afterwards (in this example DNS requests to the DNS server 9.9.9.9 were recognized by a UPnP broadcast was recognized by IDS).

Image Modified

1.6) Repeat step 1.5) for additional events if necessary.

1.7) The creation of the exception for the feature IDS/IPS is now complete.

2) Bearbeiten und Löschen der Ausnahme-RegelEditing and deleting the exception:

2.1) Go to the menu UTM → IDS/IPS.

Image Modified

2.2) You can find the exception created in step 1.5) under Ignore Rules. If necessary you can edit the exception or delete it via the "dustbin symbol", if the exception isn't needed anymore. 

Image Modified