Multiple Triggered Actions; Exempted Connections; Threshold Rules And Zonedefense; Threshold Rule Blacklisting - D-Link NetDefend DFL-210 User Manual
Network security firewall ver. 1.05
Hide thumbs
Also See for NetDefend DFL-210:
- User manual (495 pages) ,
- Log reference manual (476 pages) ,
- Cli reference manual (213 pages)
Table of Contents
Advertisement
10.2.6. Exempted Connections
10.2.5. Multiple Triggered Actions
When a rule is triggered then NetDefendOS will perform the associated rule Actions that match the
condition that has occured. If more than one Action matches the condition then those matching Ac-
tions are applied in the order they appear in the user interface.
If several Actions that have the same combination of Type and Grouping (see above for the defini-
tion of these terms) are triggered at the same time, only the Action with the highest threshold value
will be logged
10.2.6. Exempted Connections
It should be noted that some Advanced Settings known as BeforeRules settings can exempt certain
types of connections for remote management from examination by the NetDefendOS rule-set. These
settings will also exempt the connections from Threshold Rules.
10.2.7. Threshold Rules and ZoneDefense
Threshold Rules are used in the D-Link ZoneDefense feature to block the source of excessive con-
nection attmepts from internal hosts. For more information on this refer to Chapter 12, ZoneDefense.
10.2.8. Threshold Rule Blacklisting
If the Protect option is used, Threshold Rules can be configured so that the source that triggered the
rule, is added automatically to a Blacklist of IP addresses or networks. If several Protect Actions
with blacklisting enabled are triggered at the same time, only the first triggered blacklisting Action
will be executed by NetDefendOS.
A host based Action with blacklisting enabled will blacklist a single host when triggered. A network
based action with blacklisting enabled will blacklist the source network associated with the rule. If
the Threshold Rule is linked to a service then it is possible to block only that service.
When Blacklisting is chosen, then the adminstrator can elect that existing connections from the trig-
gering source can be left unaffected or they can be dropped.
The length of time, in seconds, for which the source is blacklisted can also be set.
This option is discussed further in Section 6.7, "Blacklisting Hosts and Networks".
222
Chapter 10. Traffic Management
Advertisement
Table of Contents
