Skip to main content

Add Intrusion Prevention System (IPS) policies

Updated
This article applies only to On-Premise Appliance, not to our Cloud products.

You can use Intrusion Prevention System (IPS) policies to stop unwanted activity on your internal network, such as zero-day or DDoS attacks.

To help inform how you manage your Firewall, for example, to block traffic using the source IP address, you can:

  Important

  • IPS only prevents activity for internal network traffic managed by a Port forwards rule where the IPS checkbox is selected.
  • Many potential alerts and log variations may be generated. Smoothwall Support won’t interpret these messages or advise on what actions to take.

Before you begin

  1. Check the built-in Intrusion policies and set up custom Intrusion policies if needed.
  2. Decide whether to log IPS data for the IPS logs:
    1. Go to Services > Intrusion system > Signatures.
    2. Select the Use syslog for Intrusion logging checkbox.
    3. Select Save.

Turn IPS on or off

To turn IPS off, remove all the IPS policies.

Create an IPS policy

  1. Go to Services > Intrusion system > IPS.
  2. For IPS Policy, select a policy.
  3. (Optional) Enter a Comment.
  4. Ensure Enabled is selected.
  5. Select Add.

Edit IPS polices

To edit a policy:

  1. Select the checkbox in the Mark column.
  2. Select Edit. 
  3. Change any fields as needed.
  4. Select Add.

To have the policy not apply, but keep it in the list:

  1. Select the checkbox in the Mark column.
  2. Select Edit. 
  3. Clear the Enabled checkbox.
  4. Select Add.

Delete IPS policies

To delete one or more policies:

  1. Select the checkboxes in the Mark column.
  2. Select Remove.