CHAPTER14 Security
Mediant 800 Gateway & E-SBC | User's Manual
Parameter Description
'Deny Period'
deny-period
[IDSRule_DenyPeriod]
Defines the duration (in sec) to keep the attacker on the blacklist, if
configured using the 'Deny Threshold' parameter.
The valid range is 0 to 1,000,000. The default is -1 (i.e., not
configured).
Note: The parameter is applicable only if the 'Threshold Scope'
parameter is set to IP or IP+Port.
Assigning IDS Policies
The IDS Matches table lets you implement your configured IDS Policies. You do this by assigning
IDS Policies to any, or a combination of the following configuration entities:
■ SIP Interface: For detection of malicious attacks on specific SIP Interface(s). To configure
SIP Interfaces, see Configuring SIP Interfaces.
■ Proxy Sets: For detection of malicious attacks from specified Proxy Set(s). To configure
Proxy Sets, see Configuring Proxy Sets.
■ Subnet addresses: For detection of malicious attacks from specified subnet addresses.
You can configure up to 20 IDS Policy-Matching rules.
The following procedure describes how to configure the IDS Match table through the Web interface.
You can also configure it through ini file [IDSMatch] or CLI (configure voip > ids match).
➢ To configure an IDS Policy-Matching rule:
1. Open the IDS Matches table (Setup menu > Signaling & Media tab > Intrusion Detection
folder > IDS Matches).
2. Click New; the following dialog box appears:
The figure above shows a configuration example where the IDS Policy "SIP Trunk" is applied to
SIP Interfaces 1 and 2, and to all source IP addresses outside of subnet 10.1.0.0/16 and IP
address 10.2.2.2.
3. Configure a rule according to the parameters described in the table below.
4. Click Apply, and then save your settings to flash memory.
Table 14-7: IDS Matches Table Parameter Descriptions
Parameter Description
'Index'
[IDSMatch_Index]
Defines an index number for the new table record.
'SIP Interface IDs'
sip-interface
Assigns a SIP Interface(s) to the IDS Policy. This indicates the
SIP Interfaces that are being attacked.
- 152 -
To Next Page
Loading...
