Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[flbjhb]

Hi

We have several clients linking to our servers via applications, but some of these clients send different user-agents in the communication with the web server. The User's connection is then blocked and the firewall logs the following (using ip 1.1.1.1 as an example):

1.1.1.1 - All - all 2010-02-04 23:14:02 414 IDS Rule idp_lan Signature (user-agent.Generic.PHP.Injection)

I see that user-agent.Generic.PHP.Injection is part of the rule IPS_WEB_GENERAL which contains many signatures. Would it be possible to somehow ignore just user-agent.Generic.PHP.Injection or do I have to ignore the entire IPS_WEB_GENERAL rule?

[chechito]

nice topic very usefull if has solution ... i have the same Issue

[Fatman]

Set an IDP Rule action to ignore that signature, the signature box on IDP rules is free form text.  Ensure that the ignore is above the web general group.