Can an IPS system do this?

Who cares?

But you realize that this is a very very very stupid idea?

This sort of thing?

ftp://shorewall.net/pub/shorewall/contrib/PortsentryHOWTO.txt

Jim Ford

Trust me, you DON'T want any firewall to automatically create new blocking rules.

What do you do if somebody sends spoofed packets at your firewall causing it to automatically block traffic to/from some important server?

Juergen Nieveler

When will people learn that automatic network shunning is a REALLY BAD IDEA? Rate-limiting is a much better way to deal with this kind of problem. If you can't avoid using passwords in the first place.

cu

Instantly lose connectivity?

cu

Yep, got the message loud and clear... I'll spend the effort instead ensuring the servers and apps are fully patched and tied down as much as possible.

Thanks to all.

Hm... what about an IDS? After all, just because some companies think it's funny to add a shoot-yourself-in-the-foot extension doesn't mean that the idea of detecting suspicious behaviour would be a bad idea.

Yep. An IDS sensor on a mirrored port (or hub port - most companies don`t have THAT fast Internet connections anyway) will at least tell you HOW somebody attacked your machine, which is a great help.

Juergen Nieveler

You could keep your PIX, build an IPS/IDS from some FOSS and be almost as secure as some banks... only difference, banks have managed IPS/ IDS, yours wouldn't be as much....

RedForeman