ZyXEL Communications ZyWALL Series - Page 331

Chapter 40 Reputation Filter
ZyWALL Series CLI Reference Guide
331
this file.
• The external black list file must be in text format (*.txt) with each entry separated by a new line.
• The external black list file must be stored on a web server that supports HTTP or HTTPS, and that is
reachable from the Zyxel Device.
• Each entry consists of a single IPv4/IPv6 IP address, a IPv4/IPv6 subnet in CIDR (Classless Inter-Domain
Routing) format, or an IPv4/IPv6 IP address range. For example:
104.244.79.43
188.68.0.266/31
1.1.1.1-1.1.1.3
2001:b000:168::1
• The external black list file can contain a maximum of 50,000 entries.
• If the external black list file contains any invalid entries, the Zyxel Device will not use the file.
Table 179 Commands for IP Reputation Statistics
COMMAND DESCRIPTION
[no] ip-reputation ebl
activate
Enables or disables the IP Reputation external black list.
When enabled, the Zyxel Device blocks incoming packets that come from
the listed addresses in the black list file.
ip-reputation ebl <profile
name>
Enters the subcommand mode for the specified external black list profile. If
the profile does not exist, the Zyxel Device creates it.
Note: After creating a new profile, you must add a source URL.
Failure to do so might result in an error when starting the
Zyxel Device.
description <description> Enter a description of the external black list file.
The description must consist of 1–60 characters, and may include letters,
numbers, and the following special characters:
()+/:=?!*#@$_%-
Use the no command to delete the description for this profile.
source <url>
Adds the exact file name, path and IP address of the server containing the
external black list file.
For example, http://172.16.107.20/blacklist-files/myip-ebl.txt
The server must be reachable from the Zyxel Device.
no ip-reputation ebl
<profile name>
Deletes the specified external black list profile.
ip-reputation ebl rename
old_profile_name
new_profile_name
Renames the specified external black list profile.
[no] ip-reputation ebl
update auto
Sets the Zyxel Device to automatically check for updates to the external
black list at the time and day specified. You should select a time when your
network is not busy for minimal interruption.
The [no] command disables the automatic updates.
ip-reputation ebl update
hourly
Sets the Zyxel Device to check for updates to the external black list every
hour.
ip-reputation ebl update
daily <0..23>
Sets the Zyxel Device to check for updates to the external black list once
per day, at the specified hour. For example, the time format is the 24 hour
clock, so ‘23’ means 11 PM.