][interactive] Where: – new-zone-name—A zone name string. An alphanumeric string sh
Résumé du contenu de la page N° 3
Chapter 4 Zone Configuration Basic Zone Configuration Note If no zone template is specified, the zone will be defined using the Detector DEFAULT zone template. – base-zone-name—(Optional) The name of a desired zone used as a template for the new zone. – interactive—(Optional) The operation mode of the new zone is set to interactive (see the “Interactive Recommendations Mode” section for further details). Note Choosing Enter without specifying the zone template defines a zone by the Det
Résumé du contenu de la page N° 4
Chapter 4 Zone Configuration Basic Zone Configuration 2. Choose ENTER. The following prompt appears: admin@DETECTOR–conf-zone-# To duplicate a zone from the zone command group level perform the following: 1. From the Zone command group level of the desired zone type the following: admin@DETECTOR–conf-zone-# zone copy-from–this Where new-zone-name specifies a zone name string. An alphanumeric string should start with a letter, hold no spaces, and s
Résumé du contenu de la page N° 5
Chapter 4 Zone Configuration Basic Zone Configuration Removing All Zones The user may remove all the Detector’s zones. Caution Removing all zones eliminates their DDoS detection. To remove all zones perform the following: 1. From the Configuration command group level type the following: admin@DETECTOR-conf# no zone * 2. Choose ENTER. Displaying Zone Templates The Detector enables the user to display a specific zone template or all zone templates. To display all zone templates perform the
Résumé du contenu de la page N° 6
Chapter 4 Zone Configuration Basic Zone Configuration Where: – template-name—A zone template. Options include: Default —The Guard default zone template LINK_128K—A template designed for bandwidth-limited Links LINK_1M—A template designed for bandwidth-limited Links LINK_4M—A template designed for bandwidth-limited Links LINK_512K— A template designed for bandwidth-limited Links Note If no template name is specified, the list of zone templates is displayed. 2. Choose ENTER. The following sa
Résumé du contenu de la page N° 7
Chapter 4 Zone Configuration Basic Zone Configuration Where zone-name specifies the desired zone name. 2. Choose ENTER. Below is an example of the zone command implementation: admin@DETECTOR-conf# zone scannet admin@DETECTOR-conf-zone-scannet# Describing a Zone The user may add a description to a zone for identification purposes. To add a description to a zone perform the following: 1. From the Zone command level type the following: admin@DETECTOR-conf-zone-# description
Résumé du contenu de la page N° 8
Chapter 4 Zone Configuration Basic Zone Configuration – ip-mask—(Optional) The zone IP subnet mask. Note If no mask is specified, the Detector assumes the default subnet mask 255.255.255.255. 2. Choose ENTER. Below is an example of the ip address command implementation: admin@DETECTOR-conf-zone-scannet# ip address 192.168.100.34 admin@DETECTOR-conf-zone-scannet# Note When initially defined, the zone IP address should be inserted when the zone is undetected. However, a zone’s subnet IP ad
Résumé du contenu de la page N° 9
Chapter 4 Zone Configuration Zone Remote Guard List Note If no mask is specified, the Detector assumes the default subnet mask 255.255.255.255. 2. Choose ENTER. Below is an example of the no ip address command implementation: admin@DETECTOR-conf-zone-scannet# no ip address 192.168.100.34 admin@DETECTOR-conf-zone-scannet# Removing all Zone IP Addresses The user may remove all the zone IP addresses. Caution Removing all zone IP addresses eliminates the zone DDoS detection. To remove all the
Résumé du contenu de la page N° 10
Chapter 4 Zone Configuration Zone Remote Guard List This section contains the following procedures: � Adding a Guard to the Zone Remote Guard List � Removing a Guard from the Zone Remote Guard List � Interactive Recommendations Mode Adding a Guard to the Zone Remote Guard List The user may add one or more Guards to the zone remote Guard list. To add a remote Guard or Guards to the zone remote Guard list perform the following: 1. From the Zone command group level type the following: admin@D
Résumé du contenu de la page N° 11
Chapter 4 Zone Configuration Zone Remote Guard List Where remote-guard-address specifies the remote Guard IP address. Use ‘*’ to remove all remote Guards from the remote Guard list. Caution The user should verify that the Detector has at least one remote Guard on its default remote Guard list (see the “Default Remote Guard List” section in Chapter 3, “Detector Configuration” for further details). 2. Choose ENTER. 3. Repeat steps one and two as many times as required. Below is an example
Résumé du contenu de la page N° 12
Chapter 4 Zone Configuration Zone Traffic Learning To create a new zone with interactive recommendations mode perform the following: 1. From the Configuration command group level type the following: admin@DETECTOR-conf# zone interactive 2. Choose ENTER. The new zone is created with a DEFAULT zone template configured for interactive recommendations mode. See the “Defining a New Zone” section for further details. Deactivating the Interactive Recommendation Mode The user may
Résumé du contenu de la page N° 13
Chapter 4 Zone Configuration Zone Traffic Learning The Detector’s tools for constructing detection policies are the Policy Templates. These define the policies according to the Minimum Threshold and Maximum Services parameters the user provides (this chapter will not cover those advanced procedures see Chapter 7, “Policy Procedures” for further details). Once supplied with the appropriate parameters, the Detector’s Policy Templates construct the detection policies based on the zone tra
Résumé du contenu de la page N° 14
Chapter 4 Zone Configuration Zone Traffic Learning Where zone-name specifies a zone name. Note that the Guard enables the use of an asterisk (*) as a wildcard denoting either of the following options: – All of the Guard’s zones. Issuing learning policy-construction* means setting the policy construction phase for all of the Detector’s zones. – A wildcard denoting zone names (i.e. OBL*). 2. Choose ENTER. Note Cisco recommends letting the Learning Phase 1 - Policy Construction continue f
Résumé du contenu de la page N° 15
Chapter 4 Zone Configuration Zone Traffic Learning Accepting Learning Phase 1 – Policy Construction The user may accept the Detector’s suggested policies. To accept the results of the initial Policy Construction phase perform the following: 1. From the Global command group level type the following: admin@DETECTOR# no learning accept Or alternatively: From the Zone command group level type the following: admin@DETECTOR-conf-zone-# no learning accept Where zone-name sp
Résumé du contenu de la page N° 16
Chapter 4 Zone Configuration Zone Traffic Learning Note that the Detector enables the use of an asterisk (*) as a wildcard denoting either of the following options: – All of the Detector’s zones. Issuing no learning* reject means aborting the learning phase for all of the Detector’s zones. – A wildcard denoting zone names (i.e. OBL*). 2. Choose ENTER. Learning Phase 2 – Threshold Tuning During this stage the Detector constructs its detection policies and begins to tune its traffic type
Résumé du contenu de la page N° 17
Chapter 4 Zone Configuration Zone Traffic Learning Terminating Learning Phase 2 – Threshold Tuning After a sufficient period of time (see the above note) the user ends the Threshold Tuning phase. The user may accept the Detector’s suggested policies or decide to abort the second phase of the learning process. The Detector would stop the Threshold Tuning phase and adopt the Policy Construction Phase results and the former thresholds results the Detector has. This results in a situation i
Résumé du contenu de la page N° 18
Chapter 4 Zone Configuration Zone Traffic Learning Aborting Learning Phase 2 – Tuning Threshold The user may wish to abort the second phase of learning procedure. In this case the Detector stops the process and erases the data learned on the second phase. The data gathered on the first learning phase and on the previous learning phase 2 remain unchanged. This results in a situation in which newly constructed policies have thresholds that were obtained according to past traffic characte
Résumé du contenu de la page N° 19
Chapter 4 Zone Configuration Zone Detection 2. Choose ENTER. The following (partial sample) screen appears: admin@DETECTOR-conf-zone-scannet# show policies statistics Key Rate Policy 192.168.100.34 73.17 http/80/analysis/syns/dst_ip N/A 0.17 http/80/analysis/syns/global Key Ratio Policy 192.168.100.34 1.44 tcp_ratio/any/analysis/syn_by_fin/dst_ip_ratio 80 1.44 tcp_ratio/any/analysis/syn_
Résumé du contenu de la page N° 20
Chapter 4 Zone Configuration Zone Detection Note that the Detector enables the use of an asterisk (*) as a wildcard denoting either of the following options: – All of the Detector’s zones. Issuing detect * means beginning detection for all of the Detector’s zones. – A wildcard denoting zone names (i.e. OBL*). 2. Choose ENTER. Guard-Protection Activation Forms The Detector enables the user to apply different Guard-protection forms designed to save Guard-protection resources and better fo
