10.3. Threshold Rules
Overview
The objective of a Threshold Rule is to have a means of detecting abnormal connection activity as
well as reacting to it. An example of a cause for such abnormal activity might be an internal host
becoming infected with a virus that is making repeated connections to external IP addresses. It
might alternatively be some external source trying to open excessive numbers of connections. (A
"connection" in this context refers to all types of connections, such as TCP, UDP or ICMP, tracked
by the NetDefendOS state-engine).
Note: Threshold rules are not available on all NetDefend models
The threshold rules feature is not available on the DFL-260E.
Threshold Policies
A threshold rule is like other policy based rules found in NetDefendOS. A filtering combination of
source/destination network/interface can be specified as well as a service such as HTTP. Each rule
can have one or more Threshold Action objects added to it as children and these specify how to
handle different threshold conditions.
A Threshold Action object has the following key properties:
• Action
This is the response of the rule when the limit is exceeded. Either the option Audit or Protect
can be selected. These options are explained in more detail below.
• Group By
The rule can be either Host or Network based. These options are explained below.
• Threshold
This is the numerical limit which must be exceeded for the action to be triggered.
• Threshold Type
A rule can be specified to either limit the number of connections per second or limit the total
number of concurrent connections.
Connection rate Limiting allows an administrator to put a limit on the number of new
connections being opened per second.
Total connection limiting allows the administrator to put a limit on the total number of
connections opened. This function is extremely useful when NAT pools are used since
peer-to-peer applications can require large numbers of connections.
The Group By Setting
The two groupings allowed for this property are the following:
• Host Based
Chapter 10: Traffic Management
803
To Next Page
Loading...
