Harland,
1) I am going to relocate a Proventia appliance to a new customer
and
provide them access to the box. I do not want them to be able to view
old
log files or policies on the appliance. How can I delete old policy
configurations and log files using the CLI on the box?
I would choose to perform a clean reinstall from the distribution CD,
which overwrites the old partition. I can't think of any drawback,
except perhaps reapplying XPU's which is very minor indeed.
2) I have configured a response policy with a SNMP trap
destination
and mail server. I am able to receive traps and mails when attacks or
audit events occur. How do I configure the SiteProtector so that the
appliance sends a trap and a mail when a new policy is installed on the
appliance?
Policy installation alerts don't come from the policy-based configurable
events, so you can't give them special treatment. Instead you can enable
SNMP for Sensor Low/Medium/High events (this is done from Sensor
Properties, not the policy)) which will do so for all internal events -
including policy install messages - and ignore/filter out uninteresting
messages on the trap receiver.
4) Is it possible to view in the SiteProtector how many packets
that
have been dropped by the Proventia appliance?
Try the following parameters. (Note, I have only used this on the IPSO
platform and it may not have any effect on Proventia.)
Name driver.droppedpacketnotifyenabled
Type: Boolean
Value: True/False
Description:Determines whether dropped packet notification is enabled.
Name driver.droppedpacketinterval
Type: number
Value: xxxx
Description: Specifies the elapsed number of seconds that must pass
before a dropped packet notification is generated. The timer is started
only after the first dropped packet is found.
Name pam.statistics.interval
Type: number
Value: xxxx
Description: Number of seconds between reporting sensor statistics
As far as I can remember you'll find the # of dropped packets as an
attribute of the SensorStatistics and SensorStatistics_Cumulative
events. One oddity I noticed a few months back is that if there are no
packets at all, the SensorStatistics event will not fire even though an
interval has been configured. Apart from that, the event is generated
regularly under all traffic conditions.
Cheers,
RObert
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
