

RE: [ISSForum] ISS SiteProtector and the Proventia A604 appliancequestions


>1)      I am going to relocate a Proventia appliance to a new customer
>provide them access to the box. I do not want them to be able to view
>log files or policies on the appliance. How can I delete old policy 
>configurations and log files using the CLI on the box?

I would choose to perform a clean reinstall from the distribution CD,
which overwrites the old partition. I can't think of any drawback,
except perhaps reapplying XPU's which is very minor indeed.

>2)      I have configured a response policy with a SNMP trap
>and mail server. I am able to receive traps and mails when attacks or 
>audit events occur. How do I configure the SiteProtector so that the 
>appliance sends a trap and a mail when a new policy is installed on the


Policy installation alerts don't come from the policy-based configurable
events, so you can't give them special treatment. Instead you can enable
SNMP for Sensor Low/Medium/High events (this is done from Sensor
Properties, not the policy)) which will do so for all internal events -
including policy install messages - and ignore/filter out uninteresting
messages on the trap receiver. 

>4)      Is it possible to view in the SiteProtector how many packets
>have been dropped by the Proventia appliance?

Try the following parameters. (Note, I have only used this on the IPSO
platform and it may not have any effect on Proventia.)

Name driver.droppedpacketnotifyenabled
Type: Boolean
Value: True/False
Description:Determines whether dropped packet notification is enabled.

Name driver.droppedpacketinterval
Type: number
Value: xxxx
Description: Specifies the elapsed number of seconds that must pass
before a dropped packet notification is generated. The timer is started
only after the first dropped packet is found.

Name pam.statistics.interval
Type: number
Value: xxxx
Description: Number of seconds between reporting sensor statistics

As far as I can remember you'll find the # of dropped packets as an
attribute of the SensorStatistics and SensorStatistics_Cumulative
events. One oddity I noticed a few months back is that if there are no
packets at all, the SensorStatistics event will not fire even though an
interval has been configured. Apart from that, the event is generated
regularly under all traffic conditions. 


ISSForum mailing list


