SNORT GURUZ: Question regarding Setting up Snort on a multi-WAN network

[Sanjay Arora <sanjay.k.arora () gmail com>]

Hello all

Newbie planning to setup Snort on a Small Office Network, consisting of
two 512kB/1MB ADSL WAN links with two static IPs, one LAN segment, one
DMZ and one Wi-Fi segment, connecting through a pfsense
(www.pfsense.org) box (freebsd based monowall fork) acting as a
firewall/gateway.

What is the best way to setup Snort, for analysis & IPS (simple
blackholing of attacking IPs for a few hours). Do I setup sensors on a
machine in each segment? What snort database based analysis app is
recommmended? Seperate Snort server? or a combined snort machine &
database machine? How do I sniff the WANs for snort? Is it possible for
the snort machine to have two network cards for sniffing wan traffic but
not expose an IP address to the WAN interface....esentially the nort
machine has to connect to al network segments and if this machine is
broken into, it will make a mockery of all my network security.

Ambitious project for a newbie but then I really do want to try & build
a well-segmented IDS security dimention to my network.

Snort Guru's please help with comments & pointers. I use Centos 4.2,
postgreSQL mostly but willing to change if an easier build is available
on another platform.

With best regards.
Sanjay.



-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users