[...]... MailSecurity for SMTP Gateways Configuring MailSecurity Summary 10 88 10 91 1092 10 94 10 99 11 00 11 03 11 05 11 06 11 07 11 07 11 08 11 11 111 4 11 17 11 19 11 22 11 24 11 27 11 28 11 29 11 32 11 35 11 40 11 41 114 2 11 42 11 44 11 44 11 47 11 48 11 49 11 50 11 51 115 1 11 51 115 3 11 53 11 54 11 55 11 55 11 57 11 58 11 60 11 65 11 66 11 69 11 70 11 70 11 73 11 79 252_BDFW_TOC.qxd 9 /19 /03 6:38 PM Page xxxi Contents Part VI Intrusion Detection Chapter... IDS in Production Inline IDS xxxi 11 81 118 3 11 84 11 85 11 86 11 86 11 87 11 87 11 88 11 89 11 90 11 91 119 2 11 94 11 95 11 95 11 99 11 99 12 02 12 04 12 05 12 05 12 05 12 05 12 06 12 08 12 09 12 10 12 10 12 11 1 211 12 11 1 212 12 14 12 16 12 17 12 18 12 18 12 19 12 21 12 21 1223 12 25 12 25 12 26 12 27 12 29 12 30 12 30 12 31 1235 12 40 12 43 252_BDFW_TOC.qxd xxxii 9 /19 /03 6:38 PM Page xxxii Contents Where Did the Inline IDS for Snort Come From?... Clients to Connect to Specific Port Due to a Timeout 987 987 987 988 989 989 9 91 992 993 994 994 994 995 996 996 996 997 997 999 10 05 10 05 10 05 10 06 10 06 10 07 10 07 10 07 10 08 10 08 10 08 10 09 10 09 10 10 10 10 10 11 1 012 10 12 10 12 10 13 10 13 10 13 10 14 10 14 10 14 10 15 10 15 10 15 10 15 10 16 10 17 10 17 10 17 10 17 10 18 10 18 252_BDFW_TOC.qxd 9 /19 /03 6:38 PM Page xxix Contents Troubleshooting Caching and Publishing Problems... Automated Firewall Scripts and Graphical Firewall Utilities Weighing the Benefits of a Graphical Firewall Utility Firewall Works in Progress Exercise: Using Firestarter to Create a Personal Firewall Exercise: Using Advanced Firestarter Features Summary 12 8 12 9 13 0 13 0 13 1 13 1 13 2 13 4 13 6 13 7 13 7 13 7 13 8 13 9 13 9 14 0 14 3 14 3 14 4 14 5 14 5 14 6 14 6 14 7 14 7 14 9 15 1 15 1 15 2 15 2 15 5 15 6 15 6 15 7 15 9 16 0 16 0 16 1 16 7 16 9... with the Rest of My Security Plan? Doesn’t My Firewall Serve as an IDS? Where Else Should I Be Looking for Intrusions? Backdoors and Trojans What Else Can Be Done with Intrusion Detection? Monitoring Database Access Monitoring DNS Functions xi 84 88 89 90 90 91 92 93 93 94 94 95 96 97 97 98 99 99 10 0 10 0 10 1 10 1 10 2 10 2 10 2 10 3 10 3 10 3 10 4 10 6 10 6 10 6 10 7 10 9 11 0 11 1 11 2 11 2 11 4 11 5 11 5 11 7 11 8 11 8 11 9... 10 20 10 20 10 21 1023 10 25 10 26 10 29 10 31 1032 10 32 10 33 10 34 10 35 10 38 10 38 10 40 10 41 1042 10 42 10 45 10 46 10 49 10 49 10 51 1057 10 58 10 60 10 64 10 64 10 66 10 66 10 68 10 69 10 70 10 71 10 71 1072 10 73 10 74 10 75 10 75 10 76 10 77 10 78 10 79 10 86 252_BDFW_TOC.qxd xxx 9 /19 /03 6:38 PM Page xxx Contents Exporting the Web Site Certificate and Importing the Certificate into the ISA Server Certificate Store Bridging SSL Connections... 18 0 18 1 18 2 18 2 18 4 18 5 18 6 18 6 18 6 18 7 18 8 18 9 19 0 19 1 19 1 19 2 19 5 19 5 19 6 19 7 19 9 2 01 202 203 204 205 207 207 209 211 212 212 212 213 214 214 215 216 218 219 219 219 220 220 220 252_BDFW_TOC.qxd xiv 9 /19 /03 6:38 PM Page xiv Contents Unconfiguring Solaris Routing A Three-Point Checklist Routing IP Version 6 Configuration Files The hostname6.interface File The ndpd.conf File The ipnodes File The nsswitch.conf... Column Selections System Status Summary 512 513 513 513 514 514 514 515 515 515 516 516 516 516 517 517 518 518 518 518 519 519 520 520 520 520 520 5 21 5 21 5 21 5 21 5 21 5 21 5 21 5 21 5 21 524 525 525 527 Chapter 14 Creating a Security Policy 529 Introduction Reasons for a Security Policy How to Write a Security Policy Security Design Firewall Architecture Writing the Policy Introduction Guidelines Standards... Connecting the Cluster to Your Network : Hubs or Switches? FireWall- 1 Features, Single Gateways versus Clusters :The Same, But Different Network Address Translation Security Servers Remote Authentication Servers xxiii 679 6 81 682 682 683 683 684 686 688 689 689 690 692 693 694 694 694 695 695 696 699 700 700 7 01 704 705 706 706 707 708 710 713 714 714 714 714 714 715 715 715 715 715 715 716 716 716 718 719 719 ... Your Network Is Inline IDS the Tool for Me? IDS Functionality on the PIX Firewall Supported Signatures Configuring Auditing for the PIX with an IDS Disabling Signatures Configuring Shunning Summary Index 12 43 12 44 12 58 12 60 12 61 12 61 1264 12 65 12 66 12 67 12 70 252_BDFW_Fore.qxd 9 /19 /03 6 :19 PM Page xxxiii Foreword Foreword In the beginning, there were router access lists… Then the next firewalls evolved . Detection? 11 2 Network IDS 11 4 Host-Based IDS 11 5 Distributed IDS 11 5 What Is an Intrusion? 11 7 Why Are Intrusion Detection Systems Important? 11 8 Why Are Attackers Interested in Me? 11 8 Where. Rules 515 Source 516 Destination 516 Service 516 Action 516 Track 517 Install On 517 Time 518 Comment 518 Global Properties 518 FW -1 Implied Rules 518 Viewing Implied Rules 519 SYNDefender 519 Security. Check Point VPN -1 /FireWall- 1 NG on Nokia 483 Installing the VPN -1 /FireWall- 1 NG Package 483 Upgrading IPSO Images 483 Installing VPN -1 /FireWall- 1 NG 484 Configuring VPN -1 /FireWall- 1 NG on Nokia