Table Of Contents

Using Interactive Protect Mode

Overview

Activating Interactive Protect Mode

Configuring the Zone for Interactive Protect Mode

Displaying Recommendations

Managing Recommendations

Deactivating Interactive Protect Mode

Using Interactive Protect Mode

---

When you enable zone protection, the Cisco Anomaly Guard Module (Guard module) analyzes the zone traffic and searches for policy thresholds that have been exceeded. Once it detects a policy threshold that has been exceeded, it analyzes the traffic and creates a set of dynamic filters to handle the traffic. The Guard module can activate dynamic filters either automatically or interactively. This chapter describes the interactive protect mode and includes the following sections:

•Overview

•Activating Interactive Protect Mode

•Configuring the Zone for Interactive Protect Mode

•Displaying Recommendations

•Managing Recommendations

•Deactivating Interactive Protect Mode

Overview

When a Distributed Denial of Service (DDoS) attack begins, the Guard module policies create dynamic filters. When the zone is in interactive protect mode, the Guard module does not activate these dynamic filters automatically, but waits for you to decide what action to take. The filters that await your decision are called pending dynamic filters. The Guard module groups the pending dynamic filters according to the policy that produced them in recommendations. The recommendations provide a summary of the pending filters and include information about the name of the policy that caused the creation of the pending dynamic filters, the data on the traffic anomaly that resulted in the policy activation, the number of pending dynamic filters, and the recommended action. You decide which pending dynamic filters to accept, ignore, or direct to automatic activation. The interactive protect mode gives you greater control over which actions to take when an attack is in progress.

The Guard module continues to produce pending dynamic filters as long as it is in interactive protect mode. You can activate interactive protect mode at any time during zone protection, but you can view recommendations and their pending dynamic filters only if the Guard is in interactive protect mode and a DDoS attack on the zone is in progress. You can configure the interactive protect mode when defining the zone, before or after activating zone protection.

When the Guard module has more than 1,000 pending dynamic filters, it performs the following actions:

•Displays an error message instructing you to deactivate the zone and reactivate it in automatic protect mode.

•Records the recommendations in the zone log file and report and then discards them.

The Guard module does not display a notification when new recommendations are available. To track recommendations, do one of the following tasks:

•Use the show command in zone configuration mode to display the status of the zone.

•Use the event monitor command to receive a notification when a new pending dynamic filter is created.

•Use an external syslog server to receive a notification of new pending dynamic filters.

You can stop interactive protect mode at any time and return to automatic protect mode. The Guard module disregards any decisions made while in the interactive protect mode and accepts all currently pending dynamic filters. The policies resume their role of automatically producing and activating the dynamic filters. See Chapter 8, "Configuring Policy Templates and Policies," for more information.

Activating Interactive Protect Mode

Use interactive protect mode to gain greater control over which actions the Guard module takes when an attack is in progress. If you do not activate interactive protect mode, the Guard module activates the dynamic filters automatically when it identifies an attack on the zone.

This section provides a quick overview of the steps that you need to take to activate the Guard module in interactive protect mode. Each step includes the CLI command required to complete the task.

To activate interactive protect mode, perform the following steps:

---

Step 1 Create a new zone that is configured for interactive protect mode by using the zone new-zone-name interactive command. Skip this step if the zone exists already.

user@GUARD-conf# zone scannet interactive

After you create the new zone, skip Step 2 and proceed to Step 3.

See the "Configuring the Zone for Interactive Protect Mode" section for more information.

Step 2 Configure the zone for interactive protect mode. Skip this step if you have created the zone configured for interactive protect mode.

To configure an existing zone for interactive protect mode, use the interactive command in zone configuration mode.

user@GUARD-conf-zone-scannet# interactive

See the "Configuring the Zone for Interactive Protect Mode" section for more information.

Step 3 (Optional) Configure the Guard module to display a notification when new recommendations are available by using the event monitor command.

user@GUARD# event monitor

You can also use an external syslog server to receive notification of new pending dynamic filters or manually display the status of the zone by using the show command in zone configuration mode.

Step 4 Activate the Guard module to learn the zone traffic patterns by using the learning command.

If you have created the zone for on-demand protection, you can skip this step (see the "Activating On-Demand Protection" section on page 10-3 for more information on on-demand protection).

See Chapter 9, "Learning the Zone Traffic Characteristics," for more information on the learning process.

Step 5 Activate zone protection by using the protect command.

user@GUARD-conf-zone-scannet# protect

See Chapter 10, "Protecting Zones," for more information.

Step 6 Display new recommendations and their pending dynamic filters by using the show recommendations command.

user@GUARD-conf-zone-scannet# show recommendations

user@GUARD-conf-zone-scannet# show recommendations 135 pending-filters

See "Displaying Recommendations" section for more information.

Step 7 Decide how to manage the new recommendations by using the recommendation command. You can decide to accept, ignore, or direct to automatic activation the new recommendations.

user@GUARD-conf-zone-scannet# recommendation 135 accept

See the "Managing Recommendations" section for more information.

Step 8 You can deactivate interactive protect mode at any time by using the no interactive command. The Guard module activates new dynamic filters automatically.

user@GUARD-conf-zone-scannet# no interactive

See the "Deactivating Interactive Protect Mode" section for more information.

---

Configuring the Zone for Interactive Protect Mode

To activate interactive protect mode for an existing zone, use the interactive command in zone configuration mode.

The following example shows how to activate interactive protect mode for an existing zone:

user@GUARD-conf-zone-scannet# interactive

To create a new zone configured for interactive protect mode, use the following command in configuration mode:

zone new-zone-name interactive

The new-zone-name argument specifies the name of the new zone. The zone name is an alphanumeric string that must start with a letter, cannot include any spaces, and can have a maximum of 63 characters.

The following example shows how to create a new zone configured for interactive protect mode:

user@GUARD-conf# zone scannew interactive

The new zone is created with a default zone template that is configured for interactive protect mode. See "Creating a New Zone" section on page 6-5 for more information.

Displaying Recommendations

You can display a list of all recommendations, a list of pending dynamic filters, or a specific recommendation for a zone by entering the following command in zone configuration mode:

show recommendations [recommendation-id] [pending-filters]

Table 11-1 provides the keywords and arguments for the show recommendations command.

Table 11-1 Keywords and Arguments for the show recommendations Command 

Parameter	Description
recommendation-id	(Optional) ID for a specific recommendation.
pending-filters	(Optional) Displays a list of the pending filters for a specific recommendation.

The following example shows how to display a list of all recommendations:

user@GUARD-conf-zone-scannet# show recommendations

Table 11-2 describes the fields in the show recommendations command output.

Table 11-2 Field Descriptions for the show recommendations
Command Output 

Field	Description
ID	The recommendation identification number.
Policy	The policy that created the recommendation.
Threshold	The policy threshold that was exceeded.
Detection date	The date and time that the recommendation was created.
Attack flow	The characteristics of the attack flow. The characteristics include the protocol number, source IP address, source port, destination IP address, and destination port. They indicate whether or not the traffic is fragmented. A value of any indicates that there is both fragmented and nonfragmented traffic.
Min current rate	The minimum attack rate measured in pps. For recommendations that have several pending dynamic filters, the rate of the lowest pending dynamic filter is displayed.
Max current rate	The maximum attack rate measured in pps. For recommendations that have several pending dynamic filters, the rate of the highest pending dynamic filter is displayed.
No. of pending-filters	The number of pending dynamic filters that were created because the policy threshold was exceeded.
Recommended action	The recommended action. This action is taken if you accept the recommendation.

To display a list of all recommendations with recommendation IDs before displaying pending filters for a specific recommendation, use the show recommendations command.

Table 11-3 describes the fields in the show recommendations pending-filters command output.

Table 11-3 Field Descriptions for the show recommendations pending-filters Command 

Field	Description
ID	The recommendation identification number.
Policy	The policy that created the recommendation.
Threshold	The policy threshold, in pps, that was exceeded.
Pending-filter-id	The pending dynamic filter identification number.
Detection date	The date and time that the recommendation was created.
Attack flow	The flow characteristics of the attack. The characteristics include the protocol number, source IP address, source port, destination IP address, and destination port. They indicate whether or not the traffic is fragmented. A value of any indicates that there is both fragmented and nonfragmented traffic.
Triggering rate	The attack rate, in pps, that triggered the creation of the pending dynamic filter.
Current rate	The current attack rate in pps.
Recommended action	The recommended action. This action is taken if you accept the recommendation.
Action flow	The resulting characteristics of traffic flow to the zone if you accept the pending dynamic filter. The characteristics include the protocol number, source IP address, source port, destination IP address, and destination port. They indicate whether or not the traffic is fragmented. A value of any indicates that there is both fragmented and nonfragmented traffic.

The Guard module uses an asterisk (*) as a wildcard for one of the parameters to indicate:

•The value is undetermined.

•More than one value was measured for the parameter.

---

Note You can display recommendations and their pending dynamic filters only if the Guard module is in interactive protect mode and a DDoS attack on the zone is in progress.

---

The following example shows how to display the pending dynamic filters of recommendation 135:

user@GUARD-conf-zone-scannet# show recommendations 135 pending-filters

Managing Recommendations

You can decide whether or not to activate recommendations. You can make decisions for all recommendations, a specific recommendation, or for a specific pending dynamic filter. Your decisions determine whether or not the pending dynamic filters in a policy become dynamic filters and for how long.

You can instruct the Guard module to automatically activate the pending dynamic filters of a specific policy. You can also instruct the Guard module to prevent policies from producing recommendations. The Guard module policies continue to produce recommendations if the zone is in interactive protect mode and a DDoS attack is in progress. We recommend that you display the zone status when you manage recommendations in order to verify the zone status and determine whether or not additional actions are required.

---

Note When you accept a recommendation, additional recommendations that contain the same or partial flow as the accepted recommendation and that have the same action and timeout are also accepted. The Guard module deletes these recommendations.

---

To decide on recommendations for a zone, use the following command in zone configuration mode:

recommendation recommendation-id [pending-filters pending-filter-id] decision [timeout]

Table 11-4 provides the arguments and keywords for the recommendation command.

Table 11-4 Arguments and Keywords for the recommendation
Command 

Parameter	Description
recommendation-id	Identification number of the recommendation. An asterisk (*) is a wildcard, indicating all recommendations.
pending-filter-id	(Optional) ID of a specific pending dynamic filter.
decision	Action for the recommendation. The following are possible values: •accept—Accepts the specific recommendation. The pending dynamic filters become dynamic filters. •always-accept—Accepts the specific recommendation. The decision applies automatically whenever the recommendation policy produces new recommendations. Pending dynamic filters automatically become dynamic filters. If you take this action, the Guard module no longer displays such recommendations. •always-ignore—Ignores the specific recommendation. No dynamic filter or pending dynamic filters are produced. The decision automatically applies to all future recommendations produced by the policy. If you decide to always ignore a recommendation, the Guard module no longer displays it.
timeout	(Optional) Length of time that the decision applies. The following are possible values: •forever—Activates the dynamic filters produced by the recommendations for as long as protection is in effect. This timeout is the default. See the "Configuring Dynamic Filters" section for more information. •new-timeout—Activates the dynamic filters produced by the policies for a period of time that you define. This time is measured in seconds. See the "Configuring Dynamic Filters" section for more information.

The following example shows how to accept recommendation 135:

user@GUARD-conf-zone-scannet# recommendation 135 accept

You can configure the interactive status for a specific policy, or any part of it, and decide whether or not that part of the policy should produce recommendations and pending dynamic filters. Configuring the interactive status of a policy gives you control and enables you to improve how policies adapt to traffic flows. See the "Configuring the Policy Interactive Status" section on page 8-33 for more information.

The Guard module does not display always-accept or always-ignore recommendations. When you decide to always ignore or accept a recommendation, your decision becomes part of the interactive status of the policy that created the recommendation.

You can disable or inactivate a policy to prevent the policy from producing recommendations and their pending dynamic filters. Use the state command to disable or inactivate a policy. See the "Changing the Policy State" section on page 8-21 for more information.

The following example configures the interactive status for dns_tcp/53/analysis to always-accept:

user@GUARD-conf-zone-scannet-policy-/dns_tcp/53/analysis/# 
interactive-status always-accept 

---

Deactivating Interactive Protect Mode

To deactivate the interactive protect mode, use the no interactive command in zone configuration mode. When you deactivate the interactive protect mode, the Guard module activates all new dynamic filters automatically and configures the interactive status of the policies to always-accept (see the "Displaying Policies" section on page 8-34 for information on displaying the zone policies).

The following example shows how to deactivate interactive protect mode for the zone scannet:

user@GUARD-conf-zone-scannet# no interactive