| Overview

This module introduces students to the PIX Security Appliance protocol recognition and Intrusion Detection System (IDS) capabilities. The module begins with advanced protocol handling, and how it may be tuned to fit the PIX Security Appliance operation through a series of fixup commands.

The module moves on to discuss the advanced protocols used for multimedia support including real time streaming protocols. The protocols required to support IP telephony will also be covered.

This module also discusses a series of attack guards. These are special techniques that can prevent many problems that surround popular services such as mail and Domain Name Service (DNS).

The methods of intrusion detection are discussed next. The system of intrusion detection signatures is examined, and the methods of configuration for PIX Security Appliances are explained. The process of dropping attacking packets and potentially threatening packets is called shunning. Shunning is discussed, along with configuration examples.

System logs can be configured to give administrators the information required to identify problems and attacks. Syslog files can be stored in a buffer, or routed to an external logging server. Simple Network Management Protocol (SNMP) can also be used to monitor and manage the PIX Security Appliance.

NOTE: It is required that the student study the commands covered in the chapter using the labs and the command reference. Not all required commands are covered in sufficient detail in the text alone. Successful completion of this course requires a thorough knowledge of command syntax and application.