IDS/IPS Configuration
Except on the first page, right running head:
Heading1 or Heading1NewPage text (automatic)
925
Alcatel-Lucent
Beta Beta
OmniAccess 5740 Unified Services Gateway CLI Configuration Guide
INTRUSION SENSOR OPTIONAL CONFIGURATION COMMANDS
This section lists the commands for modifying/updating the Snort database to be
used by the sensor.
T
O ENTER SNORT CONFIGURATION MODE
EXAMPLE
ALU(config)# firewall
ALU(config-firewall)# intrusion snort
ALU(config-firewall-intrusion-snort)#
T
O UPDATE SNORT DATABASE
EXAMPLE
ALU(config-firewall-intrusion-snort)# update instant https
https://idsdl.esd.alcatel-lucent.com/signature.tar.gz rebuild
Note: The URL for HTTP or HTTPS should be provided in the following way: For e.g.,
‘update instant https https://<username:password@<server-name/ip>/signature.tar.gz
passive/rebuild’.
It is preferable to upgrade the signatures from Alcatel-Lucent HTTPS server:
‘idsdl.esd.alcatel-lucent.com’ with user name ‘external’ and password ‘G#tS1g5’. It
will internally verify the signature versions and download the latest signatures.
However if you want to use an in-house HTTP server, you need to copy the signature
files and corresponding digital signatures (provided by Alcatel-Lucent) into your
private server.
For e.g., use the below command to install the latest signatures from the local server
once it is downloaded from the ALU server ‘update instant http http://<private-server>/
<path-to-the-directory>/signature-2-3-49.tar.gz passive’. This will update to signature-
2-3-49 without checking whether it is latest or not.
Command (in FwCM) Description
intrusion snort This command enters the snort
configuration mode.
Command (in Intrusion Snort CM) Description
update {instant|scheduled
{daily <hh:mm:ss>|monthly <1-
31> <hh:mm:ss>|weekly
{Sunday|Monday|..}<hh:mm:ss>}
delta <1-300>} {http|https}
<url> {passive|rebuild}}
Use this command to update the Snort
rule database through the HTTP/HTTPS
server.
This command gives the option to update
the Snort rule immediately or regularly on
the scheduled date and time.
no update [{passive|rebuild}] Use this command to remove the
scheduled Snort rule database update.
To Next Page
Loading...
Need help?
General
