WatchGuard Firebox System 7.0 User Guide

Detecting Man-in-the-Middle Attacks ............................183Blocking Sites ..............................................................184Blocking a site permanently .........................................185Creating exceptions to the Blocked Sites list ...................187Changing the auto-block duration ................................187Logging and notification for blocked sites ......................188Blocking Ports ..............................................................188Avoiding problems with legitimate users ........................191Blocking a port permanently ........................................191Auto-blocking sites that try to use blocked ports .............192Setting logging and notification for blocked ports ...........192Blocking Sites Temporarily with Service Settings .............192Configuring a service to temporarily block sites ...............193Viewing the Blocked Sites list .......................................193Integrating Intrusion Detection ......................................193Using the fbidsmate command-line utility .......................195CHAPTER 12 Setting Up Logging and Notification ...199Developing Logging and Notification Policies ................200Logging policy ..........................................................200Notification policy .....................................................201Failover Logging ..........................................................202WatchGuard Logging Architecture ................................203Designating Log Hosts for a Firebox ..............................203Adding a log host ......................................................204Enabling Syslog logging .............................................205Changing the log encryption key ..................................205Removing a log host ..................................................206Reordering log hosts ..................................................206Synchronizing log hosts ..............................................206Setting up the WatchGuard Security Event Processor ......207Running the WSEP application on Windows NT,Windows 2000, or Windows XP ............................207Viewing the WSEP application .....................................210Starting and stopping the WSEP ...................................210User Guidexix