IPS Sensor Lab

Arm the Edge — Deploy & Tune a Network IPS Sensor

Northwind Outfitters · edge firewall fw-edge-01 · WAN igb0 198.51.100.2/30

N10-009 · 4.3 APNET · 3.5 APNET · 4.5.C

SENSOR STATE · DISABLED no interface assigned

Sensor configuration · fw-edge-01

You are the on-call network analyst onboarding a new intrusion-prevention sensor on the company's edge firewall. Work top to bottom, then assign the sensor to the WAN interface and arm it. Your registered rule-feed token is VRT-7H29KQ-4M.

Rule feeds to download

Community signature ruleset

Open, no token required · broad baseline coverage

Registered subscriber ruleset

Token-gated · adds vendor-maintained signatures

Open threat-intelligence feed

Community-sourced emerging-threat indicators

Application-ID detectors

Identifies app-layer protocols for app-aware rules

Rule-feed token (required for subscriber set)

Update schedule & rule handling

Pull updates every (days)

At time (24h)

Hide deprecated / retired rules

Response & logging

Block offending hosts for (hours)

Send alert to system log when the engine starts and stops

Interface assignment

Interface

Description

Automatically block hosts that trigger an alert Send alerts on this interface to the system log

The engine refuses to start until every configuration task above is complete.

fw-edge-01 ips> ready. configure the sensor, then start it.

Task checklist

Concept questions

Callsign / handle (pseudonym — no real names)

Score: 0 / 10

Your callsign and a snapshot of this lab are sent to your instructor's submission service. No real name, email, or student ID is collected by this lab.