Ids collaboration, Overview, Enabling ids collaboration – H3C Technologies H3C SecPath F1000-E User Manual
Page 656: Configuration guidelines

1
IDS Collaboration
NOTE:
The firewall device can collaborate with only Venusense IDS devices.
Overview
IDS collaboration is introduced for firewalls to work with an Intrusion detection system (IDS) device. As
shown in
, the collaboration process is as follows:
1.
The IDS device examines network traffic for attacks.
2.
When the IDS device detects an attack, it sends an SNMP trap message to the firewall device.
The trap message may carry attack information such as source IP address of the attacker, target IP
address to be attacked, source port and destination port.
3.
When a firewall with IDS collaboration enabled receives the trap message, it retrieves the attack
information, generates a blocking entry, and blocks subsequent traffic from the source.
Figure 1 Network diagram for IDS collaboration
Enabling IDS Collaboration
Select Intrusion Detection > IDS Collaboration from the navigation tree to enter the page for
enabling IDS collaboration, as shown in
. Select the Enable IDS Collaboration check box,
and click Apply.
Figure 2 Enable IDS collaboration
Configuration Guidelines
When configuring IDS collaboration, note the following:
1.
Both the firewall devices and IDS devices must support and have SNMPv2c configured.