Cisco OL-6109-01 Bedienungsanleitung

CHAPTER

4-1

Cisco Traffic Anomaly Detector User Guide

OL-6109-01

Zone Configuration

This chapter describes zone configuration. It includes the following major

sections:

•Basic Zone Configuration

•Zone Remote Guard List

•Zone Traffic Learning

•Zone Detection

Basic Zone Configuration

This section describes the initial Zone configuration procedures that relate to zone

parameters such as: zone name, description, and zone IP address.

It describes the following procedures:

•Defining a New Zone

•Duplicating a Zone

•Removing a Zone

•Removing All Zones

•Displaying Zone Templates

•Entering a Zone Command Level

•Describing a Zone

•Defining the Zone IP Address

Chapter 4 Zone Configuration

Basic Zone Configuration

4-2

Cisco Traffic Anomaly Detector User Guide

OL-6109-01

•Removing a Zone IP Address

•Removing all Zone IP Addresses

Defining a New Zone

The Detector enables the user to define a new zone based on a variety of

templates.

To define a new zone perform the following:

1. From the Configuration command group level type the following:

admin@DETECTOR-conf# zone <new-zone-name> [<template>|copy-from

<base-zone-name>][interactive]

Where:

–

new-zone-name—A zone name string. An alphanumeric string should

start with a letter, hold no spaces, and should be limited to a length of up

to 63 characters. The string may contain underscores.

–

template—(Optional) A template that defines the zone configuration.

Options are:

Default —The Guard default zone template

Bandwidth-limited Link Templates—Templates designed and

specifically tailored for detection of large subnets segmented according

to zones with known bandwidth. Detection on zones defined by these

templates can be assumed without undergoing the learning process. It is

recommended to define such a zone with protect-ip-state of only-dest-ip

(see the “Guard-Protection Activation Forms” section for further details).

The following bandwidth-limited link templates are available for 128K,

1M, 4M, and 512K links respectively: LINK_128K, LINK_1M,

LINK_4M, and LINK_512K.

Note Learning Phase 1, policy construction, cannot be performed for

these templates.

4-3

Cisco Traffic Anomaly Detector User Guide

OL-6109-01

Chapter 4 Zone Configuration

Basic Zone Configuration

Note If no zone template is specified, the zone will be defined using

the Detector DEFAULT zone template.

–

base-zone-name—(Optional) The name of a desired zone used as a

template for the new zone.

–

interactive—(Optional) The operation mode of the new zone is set to

interactive (see the “Interactive Recommendations Mode” section for

further details).

Note Choosing Enter without specifying the zone template defines a zone

by the Detector default zone template.

2. Choose ENTER. Below is an example of the zone command implementation:

admin@DETECTOR-conf# zone scannet

admin@DETECTOR-conf-zone-scannet#

Duplicating a Zone

The user may duplicate a desired zone and define a new, identically- configured,

zone.

To duplicate a zone from the Configuration command group level perform the

following:

1. From the Configuration command group level type the following:

admin@DETECTOR-conf# zone <new-zone-name> copy-from

<base-zone-name>

Where:

–

new-zone-name—A zone name string. An alphanumeric string should

start with a letter, hold no spaces, and should be limited to a length of up

to 63 characters. The string may contain underscores.

–

base-zone-name—The name of a desired zone used as a template for the

new zone.

Chapter 4 Zone Configuration

Basic Zone Configuration

4-4

Cisco Traffic Anomaly Detector User Guide

OL-6109-01

2. Choose ENTER. The following prompt appears:

admin@DETECTOR–conf-zone-<new-zone-name>#

To duplicate a zone from the zone command group level perform the following:

1. From the Zone command group level of the desired zone type the following:

admin@DETECTOR–conf-zone-<zone-name># zone <new-zone-name>

copy-from–this

Where new-zone-name specifies a zone name string. An alphanumeric string

should start with a letter, hold no spaces, and should be limited to a length of

up to 63 characters. The string may contain underscores.

2. Choose ENTER. Below is an example of the zone command implementation:

admin@DETECTOR-conf-zone-scannet# zone mailserver copy-from-this

admin@DETECTOR-conf-zone-mailserver#

Removing a Zone

The user may remove a desired zone.

Caution Removing a zone eliminates its DDoS detection.

To remove a desired zone perform the following:

1. From the Configuration command group level type the following:

admin@DETECTOR-conf# no zone <zone-name>

Where zone-name identifies the zone name. Use ‘*’ to remove all zones.

2. Choose ENTER.

Note The Detector allows inserting an asterisk (*) as a wildcard character at the end of

a zone name. Thus, a user may use the wildcard character (*) to remove several

zones with the same prefix in one command.

4-5

Cisco Traffic Anomaly Detector User Guide

OL-6109-01

Chapter 4 Zone Configuration

Basic Zone Configuration

Removing All Zones

The user may remove all the Detector’s zones.

Caution Removing all zones eliminates their DDoS detection.

To remove all zones perform the following:

1. From the Configuration command group level type the following:

admin@DETECTOR-conf# no zone *

2. Choose ENTER.

Displaying Zone Templates

The Detector enables the user to display a specific zone template or all zone

templates.

To display all zone templates perform the following:

1. From the Configuration command group level type the following:

admin@DETECTOR-conf# show templates

2. Choose ENTER. The following (sample) screen appears:

admin@DETECTOR# show templates

DEFAULT

LINK_1M

LINK_4M

LINK_128K

LINK_512K

admin@DETECTOR#

To display a specific zone template perform the following:

1. From the Configuration command group level type the following:

admin@DETECTOR-conf# show templates [<template-name> [policies]]

Chapter 4 Zone Configuration

Basic Zone Configuration

4-6

Cisco Traffic Anomaly Detector User Guide

OL-6109-01

Where:

–

template-name—A zone template. Options include:

Default —The Guard default zone template

LINK_128K—A template designed for bandwidth-limited Links

LINK_1M—A template designed for bandwidth-limited Links

LINK_4M—A template designed for bandwidth-limited Links

LINK_512K— A template designed for bandwidth-limited Links

Note If no template name is specified, the list of zone templates is

displayed.

2. Choose ENTER. The following sample screen appears:

admin@DETECTOR-conf# show templates DEFAULT

Zone is INACTIVE

Operation Mode: AUTOMATIC

Description:

Zone ID: 0

Template: DEFAULT

PROTECT IP STATE: all-zone

FLEX-FILTER:

FLEX-FILTER ACTION: disable

admin@DETECTOR-conf#

Entering a Zone Command Level

The user should enter a zone command level to perform zone specific operations

and procedures.

To enter a zone command level perform the following:

1. From the Configuration command group level type the following:

admin@DETECTOR-conf# zone <zone-name>

Or alternatively:

From the Global command group level type the following:

admin@DETECTOR# configure <zone-name>

4-7

Cisco Traffic Anomaly Detector User Guide

OL-6109-01

Chapter 4 Zone Configuration

Basic Zone Configuration

Where zone-name specifies the desired zone name.

2. Choose ENTER. Below is an example of the zone command implementation:

admin@DETECTOR-conf# zone scannet

admin@DETECTOR-conf-zone-scannet#

Describing a Zone

The user may add a description to a zone for identification purposes.

To add a description to a zone perform the following:

1. From the Zone command level type the following:

admin@DETECTOR-conf-zone-<zone-name># description <string>

Where string specifies a string that describes the zone. The string length is

limited to a maximum of 80 characters.

2. Choose ENTER. Below is an example of the description command

implementation:

admin@DETECTOR-conf-zone-scannet# description Scannet Zone used

for demonstration purposes

admin@DETECTOR-conf-zone-scannet#

Note To modify a zone’s description repeat the zone description procedure. The new

description overrides the former.

Defining the Zone IP Address

The user must define a zone IP address to enable the Detector to perform traffic

learning and detection procedures.

To define the zone IP address perform the following:

1. From the Zone command level type the following:

admin@DETECTOR-conf-zone-<zone-name># ip address <ip-addr>

[<ip-mask>]

Where:

–

ip-addr—The zone IP address.

Chapter 4 Zone Configuration

Basic Zone Configuration

4-8

Cisco Traffic Anomaly Detector User Guide

OL-6109-01

–

ip-mask—(Optional) The zone IP subnet mask.

Note If no mask is specified, the Detector assumes the default subnet

mask 255.255.255.255.

2. Choose ENTER. Below is an example of the ip address command

implementation:

admin@DETECTOR-conf-zone-scannet# ip address 192.168.100.34

admin@DETECTOR-conf-zone-scannet#

Note When initially defined, the zone IP address should be inserted when the zone is

undetected. However, a zone’s subnet IP address or its additional IP addresses

may be added when the zone is in the detected mode.

Note The zone IP address procedure should repeat per each zone IP address or subnet

mask.

Removing a Zone IP Address

The user may remove a zone IP address.

Caution Removing a zone’s IP address may compromise the zone’s DDoS detection.

To remove a zone’s IP address perform the following:

1. From the desired Zone command group level type the following:

admin@DETECTOR-conf-zone-<zone-name># no ip address <ip-addr>

[<ip-mask>]

Where:

–

ip-addr—The zone IP address. Use ‘*’ to remove all zone IP addresses.

–

ip-mask—(Optional) The zone IP subnet mask.

4-9

Cisco Traffic Anomaly Detector User Guide

OL-6109-01

Chapter 4 Zone Configuration

Zone Remote Guard List

Note If no mask is specified, the Detector assumes the default subnet

mask 255.255.255.255.

2. Choose ENTER. Below is an example of the no ip address command

implementation:

admin@DETECTOR-conf-zone-scannet# no ip address 192.168.100.34

admin@DETECTOR-conf-zone-scannet#

Removing all Zone IP Addresses

The user may remove all the zone IP addresses.

Caution Removing all zone IP addresses eliminates the zone DDoS detection.

To remove all the zone’s IP addresses perform the following:

1. From the desired Zone command group level type the following:

admin@DETECTOR-conf-zone-<zone-name># no ip address *

2. Choose ENTER.

Zone Remote Guard List

The Detector has a list containing a Guard (or Guards) to remotely activate when

a traffic abnormality is detected. The zone remote Guard list is part of the zone

configuration. When the Detector detects a traffic abnormality it first consults the

zone remote Guard list for alerting (provided the Detector is configured for

remote-activation).

If the Detector does not find a Guard on the list it refers to the remote Guard (or

Guards) on the Detector default list (see the “Default Remote Guard List” section

in Chapter 3, “Detector Configuration” for further details).

Chapter 4 Zone Configuration

Zone Remote Guard List

4-10

Cisco Traffic Anomaly Detector User Guide

OL-6109-01

This section contains the following procedures:

•Adding a Guard to the Zone Remote Guard List

•Removing a Guard from the Zone Remote Guard List

•Interactive Recommendations Mode

Adding a Guard to the Zone Remote Guard List

The user may add one or more Guards to the zone remote Guard list.

To add a remote Guard or Guards to the zone remote Guard list perform the

following:

1. From the Zone command group level type the following:

admin@DETECTOR-conf-zone-<zone-name># remote-guard

<remote-guard-address> [<description>]

Where:

–

remote-guard-address—The desired remote Guard IP address.

–

description—(Optional) The remote Guard description (a maximum of

63 characters).

2. Choose ENTER.

3. Repeat steps one and two as many times as required.

Below is an example of the remote-guard command implementation:

admin@DETECTOR-conf-zone-scannet# remote-guard 192.168.100.33

admin@DETECTOR-conf-zone-scannet#

Removing a Guard from the Zone Remote Guard List

The user may remove a Guard from the remote Guard list.

To remove a Guard from the remote Guard list perform the following:

1. From the Zone command group level type the following:

admin@DETECTOR-conf-zone-<zone-name># no remote-guard

<remote-guard-address>

Inhaltsverzeichnis

Andere Cisco Netzwerk-Hardware Handbücher

Cisco

Cisco 5400 Bedienungsanleitung

Cisco

Cisco NSS4100 - Gigabit Storage System Bedienungsanleitung

Cisco

Cisco ONS 15454 Bedienungsanleitung

Cisco

Cisco ASR 901S Series Betriebsanleitung

Cisco

Cisco C7200-I - Input/Output Controller - Control... Bedienungsanleitung

Cisco

Cisco MERAKI MX75 Bedienungsanleitung

Cisco

Cisco Firepower 2100 Series Bedienungsanleitung

Cisco

Cisco WAE-674-K9 - Wide Area Application Engine... Handbuch

Cisco

Cisco Edge Concentrator MGX 8220 Referenzhandbuch

Cisco

Cisco Secure Firewall Management Center 1700 Bedienungsanleitung

Cisco

Cisco Cisco ONS 15600 SDH Bedienungsanleitung

Cisco

Cisco ASA 5506-X Handbuch

Cisco

Cisco IP/VC 3500 Originalbetriebsanleitung

Cisco

Cisco ONS 15454 SDH E1-75 Bedienungsanleitung

Cisco

Cisco DOC 785983 Bedienungsanleitung

Cisco

Cisco NCS 1001 Leitfaden

Cisco

Cisco ONS 15216-MD-40-ODD Bedienungsanleitung

Cisco

Cisco IPS 7.1 Bedienungsanleitung

Cisco

Cisco MDS 9500 Series Handbuch

Cisco

Cisco NCS 6008 LCC Bedienungsanleitung

Cisco

Cisco ASR 5500 Bedienungsanleitung

Cisco

Cisco ONS 15454 SDH Handbuch

Cisco

Cisco CPS-MSP-1RU-K9 Bedienungsanleitung

Cisco

Cisco Catalyst 8300 Series Handbuch

Beliebte Netzwerk-Hardware Handbücher anderer Marken

Matrix Switch Corporation

Matrix Switch Corporation MSC-HD161DEL Bedienungsanleitung

B&B Electronics

B&B Electronics ZXT9-IO-222R2 Bedienungsanleitung

Yudor

Yudor YDS-16 Bedienungsanleitung

D-Link

D-Link ShareCenter DNS-320L Bedienungsanleitung

Samsung

Samsung ES1642dc Gebrauchsanweisung

Honeywell Home

Honeywell Home LTEM-PV Montageanleitung

evertz

evertz 7700 Series Bedienungsanleitung

D-Link

D-Link ShareCenter DNS-343 Bedienungsanleitung

Asante

Asante AsanteBridge 1012 Bedienungsanleitung

FireBrick

FireBrick FB2700 Bedienungsanleitung

Audiovox Electronics

Audiovox Electronics ARWH2T Bedienungsanleitung

ADC

ADC DSX-1 Handbuch

NetComm

NetComm NF2 Bedienungsanleitung

Alcatel-Lucent

Alcatel-Lucent 5620 Bedienungsanleitung

Dell EMC

Dell EMC XC6420 Series Bedienungsanleitung

Lanner

Lanner NCA-1020A Bedienungsanleitung

Allied Telesis

Allied Telesis AT-TN121-A Bedienungsanleitung

Arista

Arista CCA-ETM-Q12 Bedienungsanleitung