Edge IPS — Turn Detection into Prevention

Harborlight Outfitters · perimeter firewall hardening · Security+ SY0-701

Your role: You are the lone security administrator at Harborlight Outfitters, a small online retailer. The open-source Snort package is already installed on the company's perimeter pfSense firewall, but right now it only watches traffic — it never stops anything. Management wants the internet-facing link actively protected before the holiday sales rush. Your job is to download the detection rule sets, schedule automatic updates, and promote Snort from a passive listener into an inline intrusion-prevention system on the WAN interface.

SY0-701 · 3.2.1.7.3 IPS/IDS 3.2.1.6.2 Inline vs. tap/monitor 3.2.1.7.5 Sensors 4.5.2.1 Trends 4.5.2.2 Signatures

Firewall administration sign-in
Use the bench credentials on your lab card.

Username

Password

Bench credentials — user admin, password Tideline#2025

Rule set sources to download

Each source is a feed of attack signatures. Enable the ones below so the engine has patterns to match traffic against.

Snort Subscriber (registered) rule setRequires your account subscription code.

Subscription (Oinkmaster-style) code Lab account code: a3f81b6c0d27e94f5b18ac6e3d70f2b9c4e15a8d

Snort GPLv2 Community rule setFree, community-maintained signatures.

Emerging Threats Open rule setOpen feed that tracks current attack trends.

OpenAppID application detectorsLets rules identify the application behind the traffic.

AppID open text rule setApplication-aware rules that build on the detectors above.

Automatic rule updates

Update interval

Update start time Run during the quiet window — schedule for 04:15.

Hide deprecated rule categoriesKeep retired signatures out of the rule list.

Blocked-host maintenance

Automatically clear blocked hosts after Policy: release offending hosts after 30 minutes.