[26218] in resnet
Re: Intrusion Prevention/Detection
daemon@ATHENA.MIT.EDU (Buraglio, Nicholas D)
Wed Apr 13 14:09:35 2011
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-ID: <51646B712A25094294672AFBB960CF68@mx.uillinois.edu>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Message-ID: <42CB6847-0D75-48AA-9925-905CE3EEF174@illinois.edu>
Date: Wed, 13 Apr 2011 18:09:15 +0000
Reply-To: Resnet Forum <RESNET-L@listserv.nd.edu>
From: "Buraglio, Nicholas D" <buraglio@illinois.edu>
To: RESNET-L@listserv.nd.edu
In-Reply-To: <021101cbfa05$4f574150$ee05c3f0$@edu>
We use a few different products. For our campus we have a primary cluster of Juniper SRX 5800 series foirewalls. They are the only device that can handle what we throw at them with multicast, IPv6 and the monumental amount of flows we generate. For various other projects we have smaller Juniper SRX series clusters (both 650 and 3600). For our residence halls we have been evaluating the Palo Alto for it's good combination of IPS/IDS, Firewall, fantastic reporting and traffic shaping abilities.
All of our devices are in-line. We also use a passive IDS in some locations to augment the IPS on the inside. We use both Bro and Snort depending on the location and function.
nb
---
Nick Buraglio
Network Engineer
University of Illinois CITES / ICCN
GPG key 0x2E5B44F4
Phone: 217.689.4254
buraglio@illinois.edu
On Apr 13, 2011, at 1:05 PM, Christopher Hickernell wrote:
> What are institutions using for Intrusion Prevention/Detection? How was your experience with evaluation, configuration, deployment and maintenance?
>
> Are you using a single appliance? Or does your IPS/IDS solution consist of multiple technologies?
>
> Does your appliance operate in-line or passive?
>
> Thank You,
>
> Christopher Hickernell, CCNA, MCSE
> Network Support Specialist, ResNet Manager
> Clarion University of Pennsylvania
> Center for Computing Services
> G-13 Still Hall, Clarion, PA 16214
> chickernell@clarion.edu | 814.393.2218
>
>
> ___________________________________________________ You are subscribed to the ResNet-L mailing list.
> To subscribe, unsubscribe or search the archives, go to http://LISTSERV.ND.EDU/archives/resnet-l.html ___________________________________________________
>
___________________________________________________
You are subscribed to the ResNet-L mailing list.
To subscribe, unsubscribe or search the archives,
go to http://LISTSERV.ND.EDU/archives/resnet-l.html
___________________________________________________
