intrusion attack

Hi all, im pretty new to the sophos firewall i noted that on the dashboard it showed an attack and also checked the logs whcih are both shown below. From this i can see that it was detected rather than blocked. Is there a way to set the IPS to block by default and if so how do i go about doing this? do is there a way of duplicating the IPS policy and changing the action to drop/block?. I am currently using the LAN to WAN IPS policy.

Added TAGs
[edited by: Raphael Alganes at 3:37 PM (GMT -7) on 15 Oct 2024]

0 Raphael Alganes 2 hours ago

Hi Charlie,

Thanks for reaching out to Sophos Community.

Could you share the SFOS version you're using,the IPS policy settings for this, and could you confirm if the action is set to Drop: https://docs.sophos.com/nsg/sophos-firewall/20.0/help/en-us/webhelp/onlinehelp/AdministratorHelp/IntrusionPrevention/IPSPolicies/IPSAddRulesToPolicy/index.html

Thanks

Raphael Alganes
Community Support Engineer | Sophos Technical Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Charlie Dodd 2 hours ago in reply to Raphael Alganes

Hi Raphael, i am currently using the free home addition, SFOS 20.0.2 MR-2-Build378. the image below shows the IPS policy that is in use. I cannot seem to edit it and it shows it is set to recommended. is there a way to duplicate this policy so that i can change the action from recommended to drop?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel