Menu

Join the Conversation

To sign in, use your existing MySonicWall account. To create a free MySonicWall account click "Register".

Sign In Register

IPS use Match Object to exclude Detection

ArminFArminF Newbie ✭
in Entry Level Firewalls

Hello.. me again i know... :)

ok, i get two ICMP IPS detection which i wanted to exclude for a server.

So i created a Match Object. But i cannot find a place to put this into a policy to exclude it for one server.

2022-08-21_19-32-08.png

I could exclude detection on IPS signature based level but just wanted to exclude it for one server.

Can you help me with that?


thank you!

armin

Category: Entry Level Firewalls
Reply

Best Answer

  • CORRECT ANSWER
    ArminFArminF Newbie ✭
    Answer ✓
    2022-08-21_19-37-02.png

    OK, Exclude Range can also be a Single IP.....

    But what for the Match Object then?

Answers

  • BWCBWC Cybersecurity Overlord ✭✭✭

    @ArminF Match Objects are used for App Rules, there is a Policy Type of "IPS Content" where your Match Object would be selectable.

    --Michael@BWC

  • ArminFArminF Newbie ✭

    Thanks Michael


    Ok, i reverted the change on the signatures directly to exclude the server.

    Created a Match Object IPS added the two option i do not want to be logged.

    Added a App Policy IPS rule and used the match object to exclude it from being logged.

    lets keep fingers crossed :)

  • ArminFArminF Newbie ✭

    Well, this is strange....


    Even when i set the App IPS Policy Rule with its Adress Source (my server) it does not save it.

    So it would i assume exclude this for all ips on the network.

    2022-08-22_15-55-55.png

    Anything i miss here?

    In this case i would might be the better way to exclude it on the IPS signatures instead of using a exclusion policy.


    thanks!

  • BWCBWC Cybersecurity Overlord ✭✭✭

    @ArminF I would definitly go for excluding the IPS Signature instead of using an AppRule, because the amount of AppRules you can configure is limited, and maybe more performance hungry.

    Even Bypassing IPS in an AppRule does not hinder the IPS to log, I checked a couple ways on a Gen6 Appliance and it always got logged. Cannot say for sure if it really gets bypassed, because usually I do this on IPS itself, which works fine.

    --Michael@BWC

  • ArminFArminF Newbie ✭

    Michael you really rock!

    Understood Sir! 😀

    Ok, will change and use exclusion on the IPS signature tab.

    Maybe create a group instead of using single entries.

    " a group for every user" i leaned once ...

Sign In or Register to comment.