|
|
|
Description
Controls the Penalty Box whitelist in SecureXL.
The SecureXL Penalty Box is a mechanism that performs an early drop of packets that arrive from suspected sources. The purpose of this feature is to allow the Security Gateway to cope better under high traffic load, possibly caused by a DoS/DDoS attack. The SecureXL Penalty Box detects clients that send packets, which the Access Control Policy drops, and clients that violate the IPS protections. If the SecureXL Penalty Box detects a specific client frequently, it puts that client in a penalty box. From that point, SecureXL drops all packets that arrive from the blocked source IP address.
The Penalty Box whitelist in SecureXL lets you configure the source IP addresses, which the SecureXL Penalty Box never blocks.
Important:
In Gaia Clish, run: set virtual-system <>
In Expert mode, run: vsenv <>
See the 'fwaccel dos config' and 'fwaccel6 dos config' commands.
Also see these commands:
Syntax for IPv4
flush whitelist -a <IPv4 Address>[/<Subnet Prefix>] -d <IPv4 Address>[/<Subnet Prefix>] -F -l -L -s |
Parameters
Parameter |
Description |
|---|---|
|
Specifies the SecureXL instance ID (for IPv4 only). |
No Parameters |
Shows the applicable built-in usage. |
|
Removes (flushes) all source IP addresses from the Penalty Box. |
|
Configures the whitelist for source IP addresses in the SecureXL Penalty Box. Important - This whitelist overrides which packet the SecureXL Penalty Box drops. Before you use a 3rd-party or automatic blacklists, add trusted networks and hosts to the whitelist to avoid outages. Note - This command is similar to the |
|
Adds the specified IP address to the Penalty Box whitelist.
Examples:
|
|
Removes the specified IP address from the Penalty Box whitelist.
|
|
Removes (flushes) all entries from the Penalty Box whitelist. |
|
Loads the Penalty Box whitelist entries from the specified plain-text file. Important:
|
|
Loads the Penalty Box whitelist entries from the plain-text file with a predefined name:
Security Gateway automatically runs this command Important:
|
|
Shows the current Penalty Box whitelist entries. |
Example 1 - Adding a host IP address without optional subnet prefix
[Expert@MyGW:0]# fwaccel dos pbox whitelist -a 192.168.20.40 [Expert@MyGW:0]# [Expert@MyGW:0]# fwaccel dos pbox whitelist -s 192.168.20.40/32 [Expert@MyGW:0]# [Expert@MyGW:0]# fwaccel dos pbox whitelist -F [Expert@MyGW:0]# fwaccel dos pbox whitelist -s [Expert@MyGW:0]# |
Example 2 - Adding a host IP address with optional subnet prefix
[Expert@MyGW:0]# fwaccel dos pbox whitelist -a 192.168.20.40/32 [Expert@MyGW:0]# [Expert@MyGW:0]# fwaccel dos pbox whitelist -s 192.168.20.40/32 [Expert@MyGW:0]# [Expert@MyGW:0]# fwaccel dos pbox whitelist -F [Expert@MyGW:0]# fwaccel dos pbox whitelist -s [Expert@MyGW:0]# |
Example 3 - Adding a network IP address with mandatory subnet prefix
[Expert@MyGW:0]# fwaccel dos pbox whitelist -a 192.168.20.0/24 [Expert@MyGW:0]# [Expert@MyGW:0]# fwaccel dos pbox whitelist -s 192.168.20.0/24 [Expert@MyGW:0]# [Expert@MyGW:0]# fwaccel dos pbox whitelist -F [Expert@MyGW:0]# fwaccel dos pbox whitelist -s [Expert@MyGW:0]# |
Example 4 - Deleting an entry
[Expert@MyGW:0]# fwaccel dos pbox whitelist -a 192.168.20.40/32 [Expert@MyGW:0]# [Expert@MyGW:0]# fwaccel dos pbox whitelist -a 192.168.20.70/32 [Expert@MyGW:0]# [Expert@MyGW:0]# fwaccel dos pbox whitelist -s 192.168.20.40/32 192.168.20.70/32 [Expert@MyGW:0]# fwaccel dos pbox whitelist -d 192.168.20.70/32 [Expert@MyGW:0]# [Expert@MyGW:0]# fwaccel dos pbox whitelist -s 192.168.20.40/32 [Expert@MyGW:0]# |
