Harland, >1) I am going to relocate a Proventia appliance to a new customer and >provide them access to the box. I do not want them to be able to view old >log files or policies on the appliance. How can I delete old policy >configurations and log files using the CLI on the box?
I would choose to perform a clean reinstall from the distribution CD, which overwrites the old partition. I can't think of any drawback, except perhaps reapplying XPU's which is very minor indeed. >2) I have configured a response policy with a SNMP trap destination >and mail server. I am able to receive traps and mails when attacks or >audit events occur. How do I configure the SiteProtector so that the >appliance sends a trap and a mail when a new policy is installed on the >appliance? Policy installation alerts don't come from the policy-based configurable events, so you can't give them special treatment. Instead you can enable SNMP for Sensor Low/Medium/High events (this is done from Sensor Properties, not the policy)) which will do so for all internal events - including policy install messages - and ignore/filter out uninteresting messages on the trap receiver. >4) Is it possible to view in the SiteProtector how many packets that >have been dropped by the Proventia appliance? Try the following parameters. (Note, I have only used this on the IPSO platform and it may not have any effect on Proventia.) Name driver.droppedpacketnotifyenabled Type: Boolean Value: True/False Description:Determines whether dropped packet notification is enabled. Name driver.droppedpacketinterval Type: number Value: xxxx Description: Specifies the elapsed number of seconds that must pass before a dropped packet notification is generated. The timer is started only after the first dropped packet is found. Name pam.statistics.interval Type: number Value: xxxx Description: Number of seconds between reporting sensor statistics As far as I can remember you'll find the # of dropped packets as an attribute of the SensorStatistics and SensorStatistics_Cumulative events. One oddity I noticed a few months back is that if there are no packets at all, the SensorStatistics event will not fire even though an interval has been configured. Apart from that, the event is generated regularly under all traffic conditions. Cheers, RObert _______________________________________________ ISSForum mailing list [email protected] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
