Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[mtcsgroup]

Hello,

I was sort became the admin of 2 units of DFL-800 on our WAN. On one of the unit we had purchase an Advanced IDP Update Service. Unfortunately with my limited knowledge and lack of documentation I find that I am unable to do P2P filtering.

I had setup a rule at the IDP Rule that I name P2P_Filter with the following parameter.

Rule name: P2P_Filter
Filter: http (I had tried tcp and tcpudp)
Source Interface: lan
Source Network: all-nets
Destination interface: wan2_dynamic (this is our WAN2 which is on dynamic DLS ip)
Source Network: all-nets

IDP rule action:
Action: Protect
Signature: POLICY_P2P_POLICY

It does not seems to work by looking at the log.

Can anyone shed some light as how do I configure the IDP/IPS services that we purchase.

Regards
Andy Ng

[Fatman]

IDS/IDP are used to scan for attacks using P2P as a vector, not to filter P2P altogether.

If your goal is to filter P2P then we may (this depends mostly on the protocol(s) we are trying to work against) be able to accomplish just that by setting up a set of IP Rules for you that are more restrictive.  It would be much simplest to continue by phone at 1 877 354 6555 (our free Business Class Support line).  If that is not an option then we can start by defining what P2P programs or protocols exactly are you trying to block?

[mtcsgroup]

IDS/IDP are used to scan for attacks using P2P as a vector, not to filter P2P altogether.

If your goal is to filter P2P then we may (this depends mostly on the protocol(s) we are trying to work against) be able to accomplish just that by setting up a set of IP Rules for you that are more restrictive.  It would be much simplest to continue by phone at 1 877 354 6555 (our free Business Class Support line).  If that is not an option then we can start by defining what P2P programs or protocols exactly are you trying to block?

Hi,

Thank you for your quick reply, the reason I am posting this is because my previous setup I was using a Zyxel ZyWall 5 with a Turbo Card and a IDP/IDS subscription. I was able to define in the filter that I want to block P2P application like BitTorrent, Emule and it is just so simple to create a rule and it works beautiful. Here I am struggling with the NetDefent DFL-800 to find a way and unsuccessful. This is 2 lines log entry from my Zyxel Zywall 5 with a Turbo card that is filtering P2P application, maybe it can give you some form of idea.

 92|2009-04-03 19:13:16  |83.133.119.143:80     |192.168.0.153:1990    |Drop Packet                     
    IDP ID:1053018, P2P BitTorrent seed download  (W1 to L)! (Repeated: 3)

 93|2009-04-03 19:11:12  |83.133.119.143:80     |192.168.0.153:1984    |Drop Packet                     
    IDP ID:1053018, P2P BitTorrent seed download  (W1 to L)!


Kindly advised because I am in Malaysia and the local support just mail me the FAQ which I had already read so I am lost and I do not think the number that you provide would work in Malaysia.

Regards
Andy Ng

P.S: As a work around I am now using OpenDNS as a curde but effective way of filtering P2P and **** Sites.

[Fatman]

Unfortunately, due to the fact that Bittorrent et cetera are not port specific your best bet is to not allow any traffic in and to enumerate all the allowable outbound traffic with applicable ALGs applied if possible.