Allow IP addresses through IPS

tantonytantony
in Firebox - Subscription Services

Good morning,

I got this email from our parent company to allow these IPs for penetration test.

**As part of the upcoming Verizon Penetration Test, please ensure that the following IP addresses are whitelisted in your firewalls.

Amazon US-EAST (Ohio or Virginia) 13.59.252.0/25, 54.175.125.192/26, 34.201.223.128/25, 3.132.217.0/25, 18.116.198.0/24, 44.192.244.0/24

Verizon Infrastructure
Verizon US-EAST (Pennsylvania) 98.117.244.1-46, 98.117.244.91-102, 108.11.193.186-190, 108.11.193.243-247**

We have Intrusion Prevention enabled on the WatchGuard, but how would I allow those IP addresses? I clicked on the Exceptions... tab, but its asking for a Signature ID, not an IP addresses.

Comments

  • Bruce_BriggsBruce_Briggs
    You add policies from those IP addrs without IPS selected on the policies
  • tantonytantony

    I created an Alias with those IP addresses, then I created a new policy below. Is this right? I don't have the 'Enable IPS for this policy checked'

  • tantonytantony

    I think that should be right? Please confirm.

  • Bruce_BriggsBruce_Briggs
    Correct
  • Bruce_BriggsBruce_Briggs
    What policy type is this?
  • tantonytantony

    I choose Any

  • tantonytantony

    There's an IPSEC policy, but I wasn't sure it that's what I should be selecting.

  • tantonytantony

    From what I understand, IPSEC is for VPN

  • tantonytantony

    Sorry, is Any the wrong type? If yes, what else should I be using? Thanks.

  • Bruce_BriggsBruce_Briggs

    Presumably an Any policy is what would be wanted by the penetration testers.

    I always find penetration test requests such as this almost the same as asking one to unlock all of the doors to your house so that the security of your house can be tested.

  • tantonytantony

    Thanks, I agree with you there. As soon as the Pen. test is over, I'll be removing this policy.

Sign In to comment.