Differences between default Intrusion prevention categories in XG

Question

Hi Community, 
 
 Been using XG Box for 3 years. IPS is another benefit of XG. Its extra security layer for the internal network. 
 All the time default policies been used. 
 What are the differences between these policies. They have the same name.

Prism · Accepted Answer

Hi, 
 
 If you check "generalpolicy", "lantowan_general", "dmzpolicy" and "lantowan_strict", all four are the exact same policies, with all IPS signatures being applied on the recommended action. 
 
 Meanwhile on the top IPS policies, that can't be deleted, they have pre-defined IPS signatures categories, with the correspondent applications that you would be running over those zones. 
 Like on the LAN to WAN you will have mostly browsing, office, c2c, and protections to Windows/Linux Systems; And you won't scan the traffic to signatures about web servers, database, ftp, since there's no servers running on that zone. 
 And on the WAN to DMZ you will have protections to servers, such as web servers, database, ftp, dns protections, at the same time you won't have protections to browsing, office, and so on. 
 
 In my opinion, It's better for you to use a "generalpolicy" and create the IPS signatures exceptions whenever necessary. And when It's needed you can clone the policy, and do any changes you feel it's needed. 
 
 Thanks!

emmosophos · Answer

Hello Can, 
 Thank you for contacting the Sophos Community! 
 The top Policies can't be edited and have specific Signatures and Categories depending on where the traffic is originating from and going to. 
 The 4 in the bottom, you can edit them and basically by default all Categories are selected, you would edit this IPS Policies according to your needs or for example if there is a signature that is being triggered but for some reason (maybe you trust the destination, or you know you system will trigger this) then you can exclude that signature from one of this profiles. Or you can copy one of these profiles and create your own! 
 Regards,

Differences between default Intrusion prevention categories in XG

Top Replies