Ids/ips no longer working

[sandu]

for the last week or so IDS/IPS is not doing the job / back to square one

it was doing a very good job until now / is alta router compromised?

any chance to be fixed? or we have to look for another solution

[WhyAydan]

IDS/IPS automatically block attempting IP after X number of alerts

I would like to request a feature to automatically block an ip after so many IDS/IPS alerts. I recently had an incident where an ip tried various exploits against my exposed blue iris server that resulted in hundreds of emails. Any way we can just have it automatically block after so many attempts? While we are at it can we please get the source/destination fixed? An alert that says my device is the source for an exploit attempt doesnt make any sense when its coming externally. I would expect s…

Take a look here, seems to be something they are aware of.

[Alta-Jeff]

There’s nothing changed from the original implementation, and nothing is broken, as far as we are aware. We are improving IPS, as stated above, however.

What exact symptoms are you seeing, and can you provide more data/logs?

[sandu]

1 IDS IPS doesn’t block brute force attacks /it worked very well ( maybe the attackers found a way to bypass )

2 when ids /ips is enabled sending emails to gmail and outlook.com or to domains hosted by google and or microsoft will not be delivered from the email server on the local network. it may a problems with others but I’ve noticed google and microsoft

[Alta-Jeff]

1. Can you be more specific in what attacks were attempted? Feel free to reach out to support to invite them to your site so they can take a look.
2. There’s nothing in our IDS/IPS implementation that blocks securely sent emails that are secured using TLS. Are you using TLS/SMTPS to send emails? If not, I strongly encourage you to do so.