D-Link NetDefendOS, User Manual

Page: 846 / 912

protocol port numbers are to be blocked.
Exclude Lists can be created and used to exclude hosts from being blocked when a threshold rule
limit is reached. Good practice includes adding to the list the firewall's interface IP or MAC
address connecting towards the ZoneDefense switch. This prevents the firewall from being
accidentally blocked out.
Example 12.1. Setting Up ZoneDefense
This example illustrates ZoneDefense setup where a host on a switch is blocked because a
threshold rule for HTTP traffic triggers. It is assumed that all interfaces on the NetDefend Firewall
have already been configured as shown below.
An HTTP threshold of 10 connections/second is to be applied to traffic. If the connection rate
exceeds this, NetDefendOS will instruct the switch to block the host (within the network range
192.168.2.0/24 ).
A D-Link switch of model type DES-3226S is assumed, with a management interface address of
192.168.1.250 and it is connected to a firewall interface with address 192.168.1.1 . This interface
will be added into the exclude list to prevent the firewall itself from being accidentally blocked
by the switch.
Web Interface
Add a new switch into ZoneDefense section:
1. Go to: Policies > Intrusion Prevention > ZoneDefense > Switches
2. Select Add > ZoneDefense Switch
3. Now enter:
• Name: switch1
• Switch model: DES-3226S
• IP Address: 192.168.1.250
4. For the SNMP Community field enter the Write Community String value configured for the
Chapter 12: ZoneDefense
846