You can utilize the "Alert" function in the "Policy" section of the Sangfor NSF1100 to create an alarm or to prohibit the connection. You can design a custom alert rule with the exact parameters you need, like "Application: SSH", "Source: internal LAN server", "Destination: public IP address", "Protocol: TCP", and "Destination Port: 443".

Then, you can select whether to send notifications to a particular email address or group and set the alert level to "High" or "Critical". By choosing the "Block" action in the alert rule, you can also set up the "Block" functionality to prevent the connection. To do this, select Policy > Alert > New Alert Rule and enter the necessary criteria there.

Hello Dear

To create an alert or block the reverse SSH tunnel on port 443 using your Sangfor NSF1100, you can follow these steps:

1. Create a Security Policy:
   - Go to the security policy settings in your Sangfor NSF1100.
   - Create a new rule specifically for traffic on port 443.

2. Set Application Recognition:
   - Ensure that application recognition is enabled for the SSH protocol. This will help identify any SSH traffic on port 443 correctly.

3. Action for Detected SSH Traffic:
   - In the rule for port 443, set the action to alert or block the traffic.
   - Choose the option to generate an alert when SSH traffic is detected on port 443.

4. Customize Alerts:
   - If possible, customize the alert to distinguish between normal traffic on port 443 (like HTTPS) and unauthorized SSH traffic.

5. Testing the Policy:
   - Test the policy by initiating a connection that should trigger the alert. Monitor the alerts generated to ensure they specifically relate to SSH traffic on port 443.

6. Review Logs and Reports:
   - Regularly check logs and reports to identify any unauthorized SSH connections that bypassed your firewall.

By creating a focused policy for port 443 and leveraging application recognition, you can better manage SSH traffic and receive relevant alerts.

Hi Zonger,
sorry but I can't find the Alert menù in policy section, I have a NSF 8.0.85, clicking on the policy menù on top bar show me only those features on the sidebar: Access Control, NAT, Network Security, Decryption, Bandwidth Management,  Authentication, Custom Webpage.
Using Access Control policy, maybe, I can create a policy to block traffic on 443 port with application=SSH, but in the policy option I have only the ability to log packet.
The Policy>Alert>New Alert Rule is a new feature of 8.0.95?
Thanks!

To create an alert or block the connection using the Sangfor NSF1100, you can use the "Alert" feature in the "Policy" section. You can create a custom alert rule that matches the specific criteria you're looking for, such as "Source: internal LAN server", "Destination: public IP address", "Protocol: TCP", "Destination Port: 443", and "Application: SSH".

You can then set the alert level to "High" or "Critical" and choose to send notifications to a specific email address or group. You can also configure the "Block" feature to block the connection by selecting the "Block" action in the alert rule. To achieve this, go to Policy > Alert > New Alert Rule, and fill in the criteria accordingly.

Hi, thanks for reply, but the question is not on how to configure firewall to send email on alerts, but is on how to configure security policy to generate an alert (and maybe block traffic) when identify ssh traffic on non standard port, like ssh traffic on 443TCP (port reserved to ssl traffic).

hi, on ngaf here's the guide to set an email alert

https://community.sangfor.com/plugin.php?id=sangfor_databases:index&mod=viewdatabase&tid=299
On nsf, here's the guide: hxxps://community.sangfor.com/plugin.php?id=sangfor_databases:index&mod=viewdatabase&tid=4944

In both guides, on the email section, you can set a flag on the more alert types you want to receive an email alert.