Intrusion Prevention
Comodo Dome Firewall includes 'Snort', a state-of-the-art network intrusion prevention and detection system (IDS/IPS) directly built-in to its IP tables. Snort employs signature, protocol, and anomaly-based inspection of incoming traffic and is the de facto IPS standard and checks the data flow through the network for intrusion detection and prevention.
Snort uses IPS rulesets, containing a number of intrusion detection/prevention rules and application detection rule sets containing a number of rules for identifying applications generating TCP/IP traffic on the network. The application rule sets enable reporting application names along with IPS events. The rules are developed by their Vulnerability Research Team (VRT) for inspecting different parts of data packets and actions to be taken. The rule sets are constantly updated to confront emerging network intrusion techniques, that can be periodically downloaded from Snort servers. Using up-to-date rule sets enables Dome Firewall to detect and prevent unprecedented network intrusions attempts.
The Intrusion Prevention System interface allows the administrator to configure Snort rules update schedule, create and upload Snort rules and enable/disable rule sets.
- Click 'Services' > 'Intrusion Prevention' from the left hand side navigation.
The Interface has three tabs:
- IPS Settings - Allows the administrator to enable/disable the intrusion prevention system and configure ruleset updates. See Configure Intrusion Prevention System for more details.
- IPS Rules - Currently loaded IPS rulesets and allows the administrator to manage them. See Manage IPS Rulesets for more details.
- Application Identification - Currently loaded Application Identification rulesets and allows the administrator to manage them. See Manage Application Identification Rulesets for more details.