Table Of Contents

Interactive Protect Mode

Overview

Activating the Interactive Protect Mode

Viewing Recommendations

Activating Recommendations

Interactive Protect Mode

---

The Guard module analyses diverted zone traffic in search of policy threshold violations. Once it detects a policy threshold violation, it analyses the results and creates a set of filters that can either be activated automatically or interactively. This chapter describes the interactive protect mode and includes the following major sections:

•Overview

•Activating the Interactive Protect Mode

•Viewing Recommendations

•Activating Recommendations

Overview

When a DDoS attack begins, the Guard module policies create Dynamic filters. When the zone is in interactive protect mode, the Guard module does not activate these Dynamic filters automatically, but waits for your decision. These filters are called pending Dynamic filters. The recommendations are a summary of the pending filters according to the policies that produced them. The information includes the policy name that recommended it, data on the traffic anomaly that resulted in policy activation, the number of pending Dynamic filters and the recommended action. You decide which pending Dynamic filters to accept, ignore, or direct to automatic activation, thus giving you greater control over what measures to take when an attack is in progress.

The Guard continues to produce pending Dynamic filters to protect the zone as long as it is in interactive protect mode. You can activate interactive protect mode at any time during zone protect mode, but can only view recommendations and their pending Dynamic filters if the Guard is in interactive protect mode and a DDoS attack on the zone is in progress. You can apply the interactive protect to a zone when defining the zone, or before or after initiating zone protect mode.

When the The Guard module has more than 1000 pending Dynamic filters, it performs the following:

•It displays an error message instructing you to deactivate the zone and reactivate it in automatic protect mode

•It records the recommendations in the zone log file and report and then discards them

The Guard module does not display a notification when new recommendations are available. To keep track of recommendations, do one of the following:

•Use the show command in zone configuration mode to view the status of the zone

•Use the event monitor command to receive notification when a new pending Dynamic filter is created

•Use an external syslog server to receive notification of new pending Dynamic filters

You can stop interactive protect mode at any time and return to automatic protect mode. The Guard module disregards any decisions made while in the interactive mode and accepts all currently pending Dynamic filters. The policies resume their role of automatically producing and activating the Dynamic filters (see "Configuring Policy Templates and Policies").

Activating the Interactive Protect Mode

To activate the interactive protect mode for an existing zone, enter interactive in zone configuration mode.

To create a new zone configured for interactive protect mode, enter the following command in configuration mode:

zone new-zone-name interactive

The new-zone-name argument specifies the name of the new zone. The zone name is an alphanumeric string that must start with a letter, cannot include any spaces and can have no more than 63 characters.

For example:

admin@GUARD-conf# zone scannew interactive

The new zone is created with a default zone template, configured for interactive protect mode. See "Configuring Zones" for further details.

Use the no interactive command to deactivate the interactive protect mode. When you deactivate the interactive protect mode, the interactive status of the policies becomes always-accept.

Viewing Recommendations

Use the show recommendations command to view a list of all recommendations, a list of pending Dynamic filters or a specific recommendation for a zone. Enter the following command:

show recommendations [recommendation-id] [pending-filters]

Table 9-1 provides the keywords and arguments for the show recommendations command.

Table 9-1 Keywords and Arguments for the show recommendations Command 

Parameter	Description
recommendation-id	(Optional) The ID for a specific recommendation.
pending-filters	(Optional) Displays a list of the pending filters for a specific recommendation.

For example:

admin@GUARD-conf-zone-scannet# show recommendations

Table 9-2

Table 9-2 Field Descriptions for the show recommendations Command 

Field	Description
ID	The recommendation identification number.
Policy	The policy that created the recommendation.
Threshold	The policy threshold that was violated.
Detection date	The date and time the recommendation was created.
Attack flow	The characteristics of the attack flow. The characteristics include the protocol number, source IP address, source port, destination IP address, destination port and indicates whether the traffic is fragmented or not. Any indicates that there is both fragmented and non-fragmented traffic.
Min current rate	The minimum attack rate measured in pps. For recommendations that have several pending Dynamic filters, the rate of the lowest pending Dynamic filter is displayed.
Max current rate	Maximum attack rate measured in pps. For recommendations that have several pending Dynamic filters, the rate of the highest pending Dynamic filter is displayed.
No. of pending-filters	The number of pending Dynamic filters that were created as a result of the policy threshold violations.
Recommended action	The recommended action. This action is taken if you accept the recommendation.

describes the fields in the show recommendations command output.

Use the show recommendations command to display a list of all recommendations with recommendation IDs before displaying pending filters for a specific recommendation.

Table 9-3 describes the fields in the show recommendations pending-filters command output.

Table 9-3 Field Descriptions for the show recommendations pending-filters Command 

Field	Description
ID	The recommendation identification number.
Policy	The policy that created the recommendation.
Threshold	The policy threshold, in pps, that was violated.
Pending-filter-id	The pending Dynamic filter identification number.
Detection date	The date and time the recommendation was created.
Attack flow	The flow characteristics of the attack. The characteristics include the protocol number, source IP address, source port, destination IP address, destination port and indicates whether the traffic is fragmented or not. Any indicates that there is both fragmented and non-fragmented traffic.
Triggering rate	The attack rate (in pps) that triggered the creation of the pending Dynamic filter.
Current rate	The current attack rate in pps.
Recommended action	The recommended action. This action is taken if you accept the recommendation.
Action flow	The resulting characteristics of traffic flow to the zone if you accept the pending Dynamic filter. The characteristics include the protocol number, source IP address, source port, destination IP address, destination port and indicates whether the traffic is fragmented or not. Any indicates that there is both fragmented and non-fragmented traffic.

A value of * for any of the parameters indicates one of the following:

•The value is undetermined

•More than one value was measured for the parameter

---

Note You can only view recommendations and their pending Dynamic filters if the Guard is in interactive protect mode and a DDoS attack on the zone is in progress.

---

For example:

admin@GUARD-conf-zone-scannet# show recommendations 135 pending-filters

Activating Recommendations

You can decide whether or not to activate recommendations. You can make decisions for all recommendations, a specific recommendation, or for a specific pending Dynamic filter. Your decisions determine whether the pending Dynamic filters in a policy become Dynamic filters and for how long.

You can instruct the Guard module to automatically activate the pending Dynamic filters of a specific policy. You can also instruct the Guard module to prevent policies from producing recommendations. The Guard module policies continue to produce recommendations as the DDoS attack continues and changes its characteristics.

View the zone status after making decisions to verify your decisions.

---

Note When you accept a recommendation, additional recommendations that contain the same or partial flow as the accepted recommendation and have the same action and timeout are also accepted. The Guard module deletes these recommendations.

---

Use the recommendation command in zone configuration mode to decide on recommendations for a zone. Enter the following command:

recommendation recommendation-id [pending-filters pending-filter-id] decision [timeout]

Table 9-4 provides the arguments and keywords for the recommendation command.

Table 9-4 Arguments and Keywords for the recommendation Command 

Parameters	Description
recommendation-id	The specific recommendation identification number. An asterisk (*) is a wildcard indicating all recommendations.
pending-filter-id	(Optional) The ID for a specific pending Dynamic filter.
decision	The action taken on the recommendation. Possible values are: •accept—Accepts the specific recommendation. The pending Dynamic filters become Dynamic filters. •always-accept—Accepts the specific recommendation. The decision applies automatically whenever the recommendation policy produces new recommendations. Pending Dynamic filters automatically become Dynamic filters. If you take this action, the Guard will no longer display such recommendations. •always-ignore—Ignores the specific recommendation. No Dynamic filter or pending v filters are produced. The decision automatically applies to all future recommendations produced by the policy. If you decide to always ignore a recommendation, the Guard no longer display it.
timeout	(Optional) The length of time in seconds that the decision applies. Possible value are: •forever—The Guard activates the Dynamic filters (see the "Configuring Dynamic Filters" section for further details) produced by the recommendations for as long as protection is in effect. •new-timeout—The Guard activates the Dynamic filters (see "Configuring Dynamic Filters" section for further details) produced by the policies for period of time that you define.

You can configure the interactive status for a specific policy, or any part of it, and decide whether that part of the policy should produce recommendations and pending Dynamic filters. See "Configuring the Interactive Status" section for further details. This gives you greater control and enables you to improve how policies adapt to traffic flows.

The Guard does not display always-accept or always-ignore recommendations. When you decide to always ignore or accept a recommendation, your decision becomes part of the interactive-status of the policy that created the recommendation.

You can disable or inactivate a policy in order to prevent it from producing recommendations and their pending Dynamic filters. Use the state command to disable or inactivate a policy. See the "Changing the Policy State" section for further details.

The following example configures the interactive status for dns_tcp policy templates with service 53, using the analysis protection module:

admin@GUARD-conf-zone-scannet-policy-/dns_tcp/53/analysis/# 
interactive-status always-accept 

See "The Policy Sections" section for further details.