McAfee GUARD DOG 2 Installation Guide

Special Topicsversion 200510McAfee®IntruShield® IPS SystemBest PracticesMcAfee® Network ProtectionIndustry-leading intrusion prevention solutions

6McAfee®IntruShield® IPS System IntruShield Best PracticesSpecial Topics: Best Practices Ensuring connectivity between the sensor and other network d

7McAfee®IntruShield® IPS System IntruShield Best PracticesSpecial Topics: Best Practices Ensuring connectivity between the sensor and other network d

8McAfee®IntruShield® IPS System IntruShield Best PracticesSpecial Topics: Best Practices Ensuring connectivity between the sensor and other network d

9McAfee®IntruShield® IPS System IntruShield Best PracticesSpecial Topics: Best Practices Initial tuning1Auto-negotiationAuto-negotiation issues typic

10McAfee®IntruShield® IPS System IntruShield Best PracticesSpecial Topics: Best Practices Initial tuning1Many of the top alerts seen on the initial d

11McAfee®IntruShield® IPS System IntruShield Best PracticesSpecial Topics: Best Practices Initial tuning1Sensor actions There are multiple sensor act

12McAfee®IntruShield® IPS System IntruShield Best PracticesSpecial Topics: Best Practices Creating rule sets1Creating rule setsProper creation of rul

13McAfee®IntruShield® IPS System IntruShield Best PracticesSpecial Topics: Best Practices Maintenance, backup, and database tuning1Maintenance, backu

14McAfee®IntruShield® IPS System IntruShield Best PracticesSpecial Topics: Best Practices Maintenance, backup, and database tuning1Alerts and disk sp

15McAfee®IntruShield® IPS System IntruShield Best PracticesSpecial Topics: Best Practices Maintenance, backup, and database tuning1Purge.batThe purge

COPYRIGHT© 2002 - 2005 McAfee, Inc. All Rights Reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieva

16McAfee®IntruShield® IPS System IntruShield Best PracticesSpecial Topics: Best Practices Access Control Lists (ACL)1 Test restoration of backups pe

17McAfee®IntruShield® IPS System IntruShield Best PracticesSpecial Topics: Best Practices Working on performance issues1Working on performance issues

18McAfee®IntruShield® IPS System IntruShield Best PracticesSpecial Topics: Best Practices SSL best practices1SSL best practicesNote that there is a p

19McAfee®IntruShield® IPS System IntruShield Best PracticesSpecial Topics: Best Practices SSL best practices1Supported Web serversSSL decryption is s

20McAfee®IntruShield® IPS System IntruShield Best PracticesSpecial Topics: Best Practices Sensor performance with HTTP Response processing1 TLS_RSA_

21McAfee®IntruShield® IPS System IntruShield Best PracticesSpecial Topics: Best Practices Sensor performance with HTTP Response processing1HTTP Respo

iiiTable of Contents1 IntruShield Best Practices 1Contents of this document . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

ivMcAfee®IntruShield®IPS System 2.1 User-Defined Signatures Developer’s GuideUnsupported SSL functionality. . . . . . . . . . . . . . . . . . . . . .

11IntruShield Best PracticesThis document discusses recommended practices for using IntruShield most effectively. Topics covered include installation,

2McAfee®IntruShield® IPS System IntruShield Best PracticesSpecial Topics: Best Practices Pre-installation considerations1Pre-installation considerati

3McAfee®IntruShield® IPS System IntruShield Best PracticesSpecial Topics: Best Practices Deploying a large number of sensors1Deploying a large number

4McAfee®IntruShield® IPS System IntruShield Best PracticesSpecial Topics: Best Practices Facilitating troubleshooting1 Alert Traffic - if “chatty” p

5McAfee®IntruShield® IPS System IntruShield Best PracticesSpecial Topics: Best Practices Ensuring connectivity between the sensor and other network d