WSM User Guide - WatchGuard Technologies

Configuring Intrusion PreventionConfiguring intrusion prevention for HTTP or TCPThe HTTP and TCP proxies include options to prevent Instant Messaging (IM), Peer to Peer (P2P), andspyware use.If you use the TCP proxy and the HTTP proxy, you must be sure to configure actions for IM, P2P, and spywarein the two proxies to apply actions to all IM, P2P, and spyware traffic.1 Select the Enable Intrusion Prevention check box.2 (HTTP only) Under Signatures, click one or both check boxes to use a more accurate list ofsignatures for HTTP client endpoints, HTTP server endpoints, or both.3 In the Actions section, use the drop-down lists to select the Firebox action for each severity level.AllowYou allow a packet so it can get to its recipient, even if the content matches a signature.DenyYou deny a packet to stop it and send a TCP reset packet to the sender.DropYou drop a packet to deny it, but send no TCP reset packet to the sender.BlockYou block a message to drop the packet, and to add the IP address that the packet started fromto the Blocked Sites list.Preventing Instant Messaging (IM) useThe HTTP Proxy has options to prevent Instant Messaging (IM) use. It finds these IM services:• AOL Instant Messenger (AIM)• ICQ• MSN Messenger• Yahoo Messenger1 From the Intrusion Prevention Services fields of the HTTP proxy, click the IM tab.User Guide 317