Intrusion Prevention and Content Security (IPS, Anti-Virus, URL Filtering)
IPS
IPS inspects packets and flows against signatures for known exploit patterns and anomaly rules. A signature has an ID, severity, action (alert or block) and direction. The IPS profile is bound to a security policy, so only traffic that the policy permits is inspected. Signature databases need regular updates, and custom signatures cover local applications.
Anti-virus
Scans files over HTTP, FTP, SMTP, POP3 and IMAP. It uses a virus database plus heuristic detection, has a maximum file size, and can block or alert. Encrypted traffic must be decrypted before scanning.
URL filtering
Matches URLs against predefined categories and custom lists; actions are permit, block or alert. HTTPS URLs need SSL decryption, with a certificate on the firewall, to be visible. Content filtering blocks keywords and file types.
Worked example
Requirement: block social media but allow business sites, and block .exe downloads over HTTP. Reasoning: create a URL filtering profile with the social-media category blocked and a whitelist for the company portal; add a content-filtering rule for the exe file type; bind both profiles to the Trust to Untrust permit policy. Test with a URL from each category and confirm results in the threat logs.
Traps that cost marks
- Expecting IPS to block traffic the security policy already denies; it never sees it.
- Forgetting that the profile must be bound to a policy.
- Assuming URL filtering sees HTTPS paths without decryption.
- Ignoring signature and database updates, which quickly degrade detection.