C H A P T E R 4 Zone Configuration This chapter describes zone configuration. It includes the following major sections: • Basic Zone Configuration • Zone Remote Guard List • Zone Traffic Learning • Zone Detection Basic Zone Configuration This section describes the initial Zone configuration procedures that relate to zone parameters such as: zone name, description, and zone IP address.
Chapter 4 Zone Configuration Basic Zone Configuration • Removing a Zone IP Address • Removing all Zone IP Addresses Defining a New Zone The Detector enables the user to define a new zone based on a variety of templates. To define a new zone perform the following: 1. From the Configuration command group level type the following: admin@DETECTOR-conf# zone [|copy-from ][interactive] Where: – new-zone-name—A zone name string.
Chapter 4 Zone Configuration Basic Zone Configuration Note If no zone template is specified, the zone will be defined using the Detector DEFAULT zone template. – base-zone-name—(Optional) The name of a desired zone used as a template for the new zone. – interactive—(Optional) The operation mode of the new zone is set to interactive (see the “Interactive Recommendations Mode” section for further details).
Chapter 4 Zone Configuration Basic Zone Configuration 2. Choose ENTER. The following prompt appears: admin@DETECTOR–conf-zone-# To duplicate a zone from the zone command group level perform the following: 1. From the Zone command group level of the desired zone type the following: admin@DETECTOR–conf-zone-# zone copy-from–this Where new-zone-name specifies a zone name string.
Chapter 4 Zone Configuration Basic Zone Configuration Removing All Zones The user may remove all the Detector’s zones. Caution Removing all zones eliminates their DDoS detection. To remove all zones perform the following: 1. From the Configuration command group level type the following: admin@DETECTOR-conf# no zone * 2. Choose ENTER. Displaying Zone Templates The Detector enables the user to display a specific zone template or all zone templates.
Chapter 4 Zone Configuration Basic Zone Configuration Where: – template-name—A zone template. Options include: Default —The Guard default zone template LINK_128K—A template designed for bandwidth-limited Links LINK_1M—A template designed for bandwidth-limited Links LINK_4M—A template designed for bandwidth-limited Links LINK_512K— A template designed for bandwidth-limited Links Note 2. If no template name is specified, the list of zone templates is displayed. Choose ENTER.
Chapter 4 Zone Configuration Basic Zone Configuration Where zone-name specifies the desired zone name. 2. Choose ENTER. Below is an example of the zone command implementation: admin@DETECTOR-conf# zone scannet admin@DETECTOR-conf-zone-scannet# Describing a Zone The user may add a description to a zone for identification purposes. To add a description to a zone perform the following: 1.
Chapter 4 Zone Configuration Basic Zone Configuration – ip-mask—(Optional) The zone IP subnet mask. Note 2. If no mask is specified, the Detector assumes the default subnet mask 255.255.255.255. Choose ENTER. Below is an example of the ip address command implementation: admin@DETECTOR-conf-zone-scannet# ip address 192.168.100.34 admin@DETECTOR-conf-zone-scannet# Note When initially defined, the zone IP address should be inserted when the zone is undetected.
Chapter 4 Zone Configuration Zone Remote Guard List Note 2. If no mask is specified, the Detector assumes the default subnet mask 255.255.255.255. Choose ENTER. Below is an example of the no ip address command implementation: admin@DETECTOR-conf-zone-scannet# no ip address 192.168.100.34 admin@DETECTOR-conf-zone-scannet# Removing all Zone IP Addresses The user may remove all the zone IP addresses. Caution Removing all zone IP addresses eliminates the zone DDoS detection.
Chapter 4 Zone Configuration Zone Remote Guard List This section contains the following procedures: • Adding a Guard to the Zone Remote Guard List • Removing a Guard from the Zone Remote Guard List • Interactive Recommendations Mode Adding a Guard to the Zone Remote Guard List The user may add one or more Guards to the zone remote Guard list. To add a remote Guard or Guards to the zone remote Guard list perform the following: 1.
Chapter 4 Zone Configuration Zone Remote Guard List Where remote-guard-address specifies the remote Guard IP address. Use ‘*’ to remove all remote Guards from the remote Guard list. Caution The user should verify that the Detector has at least one remote Guard on its default remote Guard list (see the “Default Remote Guard List” section in Chapter 3, “Detector Configuration” for further details). 2. Choose ENTER. 3. Repeat steps one and two as many times as required.
Chapter 4 Zone Configuration Zone Traffic Learning To create a new zone with interactive recommendations mode perform the following: 1. From the Configuration command group level type the following: admin@DETECTOR-conf# zone interactive 2. Choose ENTER. The new zone is created with a DEFAULT zone template configured for interactive recommendations mode. See the “Defining a New Zone” section for further details.
Chapter 4 Zone Configuration Zone Traffic Learning The Detector’s tools for constructing detection policies are the Policy Templates. These define the policies according to the Minimum Threshold and Maximum Services parameters the user provides (this chapter will not cover those advanced procedures see Chapter 7, “Policy Procedures” for further details).
Chapter 4 Zone Configuration Zone Traffic Learning Where zone-name specifies a zone name. Note that the Guard enables the use of an asterisk (*) as a wildcard denoting either of the following options: – All of the Guard’s zones. Issuing learning policy-construction* means setting the policy construction phase for all of the Detector’s zones. – A wildcard denoting zone names (i.e. OBL*). 2. Choose ENTER.
Chapter 4 Zone Configuration Zone Traffic Learning Accepting Learning Phase 1 – Policy Construction The user may accept the Detector’s suggested policies. To accept the results of the initial Policy Construction phase perform the following: 1.
Chapter 4 Zone Configuration Zone Traffic Learning Note that the Detector enables the use of an asterisk (*) as a wildcard denoting either of the following options: – All of the Detector’s zones. Issuing no learning* reject means aborting the learning phase for all of the Detector’s zones. – A wildcard denoting zone names (i.e. OBL*). 2. Choose ENTER.
Chapter 4 Zone Configuration Zone Traffic Learning Terminating Learning Phase 2 – Threshold Tuning After a sufficient period of time (see the above note) the user ends the Threshold Tuning phase. The user may accept the Detector’s suggested policies or decide to abort the second phase of the learning process. The Detector would stop the Threshold Tuning phase and adopt the Policy Construction Phase results and the former thresholds results the Detector has.
Chapter 4 Zone Configuration Zone Traffic Learning Aborting Learning Phase 2 – Tuning Threshold The user may wish to abort the second phase of learning procedure. In this case the Detector stops the process and erases the data learned on the second phase. The data gathered on the first learning phase and on the previous learning phase 2 remain unchanged. This results in a situation in which newly constructed policies have thresholds that were obtained according to past traffic characteristics.
Chapter 4 Zone Configuration Zone Detection 2. Choose ENTER. The following (partial sample) screen appears: admin@DETECTOR-conf-zone-scannet# show policies statistics Key Rate Policy 192.168.100.34 73.17 http/80/analysis/syns/dst_ip N/A 0.17 http/80/analysis/syns/global Key Ratio Policy 192.168.100.34 1.44 tcp_ratio/any/analysis/syn_by_fin/dst_ip_ratio 80 1.44 tcp_ratio/any/analysis/syn_by_fin/dst_port_ratio Key Connections Policy N/A 429.
Chapter 4 Zone Configuration Zone Detection Note that the Detector enables the use of an asterisk (*) as a wildcard denoting either of the following options: – All of the Detector’s zones. Issuing detect * means beginning detection for all of the Detector’s zones. – A wildcard denoting zone names (i.e. OBL*). 2. Choose ENTER.
Chapter 4 Zone Configuration Zone Detection Where: – all-zone—The Detector activates the Guard to assume protection over the overall zone whenever a traffic abnormality is detected (see this section’s explanation for further details). – only-dest-ip—The Detector activates the Guard protection over a particular zone once a traffic abnormality can be traced as destined to that particular zone (see this section’s explanation for further details).
Chapter 4 Zone Configuration Zone Detection The sample screen indicates that zone traffic is mirrored (or split), the Detector receives the zone’s traffic and the traffic shows normal flow fluctuations. Zone detection is functioning properly. Ending the Zone Detection The user may wish to end the zone detection.
