D-Link Forums

The Graveyard - Products No Longer Supported => D-Link NetDefend Firewalls => Topic started by: WilliFixit on January 15, 2010, 08:01:49 PM

Title: What/How to secure after getting IDP subscription
Post by: WilliFixit on January 15, 2010, 08:01:49 PM

I just found out that just buying an IDP subscription only updates a database of signatures, and that by default NONE of them are active.

Where should I look to learn/understand the next steps of properly setting up the router for a small business to best utilize the subscription?  It is kind of overwhelming with the 260+ signature groups and 19,000+ signatures.  I don't know where to start to leverage this subscription.

Thanks,

Will

Title: Re: What/How to secure after getting IDP subscription
Post by: danilovav on January 16, 2010, 09:51:58 PM

Visit security.dlink.com.tw, make registration and input your license code with MAC address and serial number. After just start update.

Title: Re: What/How to secure after getting IDP subscription
Post by: chechito on January 17, 2010, 07:02:14 AM

first
go to maintenance --> license in the web ui of the firewall to activate the license

second
go to maintenance --> Update center and and check to enable automatic updates

third
go to IDP/IPS -->  IDP rules and build your rules to apply signatures.

I suggest you to read and search to understand the details of the signatures before applying it, they only apply and are effective if you use it to scan appropriated protocols otherwise you can obtain false positives and useless overhead to the firewall, you may need some skills or aknowledge of security threads to understand how and when use the signatures.

Always its best to configure audit mode to monitor performance and logs before apply protect mode.

Take your time, A IDS not sets up in 15 minutes, hours of work are needed to reach good setup of rules that secure the network and avoid false positives, which can be annoying to he network users


Good luck and share your experiences to get the best of our DFL products

Title: Re: What/How to secure after getting IDP subscription
Post by: WilliFixit on January 17, 2010, 09:33:54 AM

Quote from: chechito on January 17, 2010, 07:02:14 AM

first
go to maintenance --> license in the web ui of the firewall to activate the license

second
go to maintenance --> Update center and and check to enable automatic updates

third
go to IDP/IPS -->  IDP rules and build your rules to apply signatures.

Thanks, I already had steps 1 & 2 done, I was wondering where to go to get guidelines for the IDP rules, like what rules for what type of protection, etc.  So I am still looking for more.

Title: Re: What/How to secure after getting IDP subscription
Post by: chechito on January 17, 2010, 10:12:23 AM

in

http://security.dlink.com.tw/netdefend_ids.asp

after registration you can search signatures by name and get some additional information


About the rules, its the same like ip rule