90
SBC session border controllers
4.1.8.3
Dynamic firewall
Dynamic firewall
— a utility that tracks attempts of access to various services. When constantly repeated
unsuccessful access attempts from the same IP address/host are discovered, the dynamic firewall blocks all further
access attempts from this IP address/host.
The following actions may be identified as an unsuccessful access attempt:
–
bruteforcing web interface or SSH authentication data, i.e. attempts to log in to the management interface
using a wrong login or password;
–
authentication data matching — accepting REGISTER requests from a known IP address, but with incorrect
authentication data;
–
receiving requests (REGISTER, INIVITE, SUBSCRIBE, etc.) from an unknown IP address;
–
accepting unknown requests via a SIP port;
–
the call falls under a rule with reject policy.
Security –> Dynamic firewall
Dynamic firewall parameters
Enable
— enable a firewall;
The following parameters can be configured separately for different services. All these parameters can be
reset to default values using the «Default» button.
Block time, sec
— time in seconds during which access from the suspicious address will be blocked;
Forgive time, sec
— time after which the address from which a suspicious request came will be forgotten if
it has never been blocked;
Access attempts before blocking
— the maximum number of unsuccessful attempts to access the service
before the host is blocked;
Block attempts before black-listing
— the number of blockages after which a problem address will be
forcibly blacklisted;
Progressive block
— when this flag is set, each subsequent address block will be twice as large as the
previous one, twice as few access attempts will be used to block the address. For example, the first time
the address was blocked for 30 seconds after 16 attempts, the second time – for 60 seconds after 8
attempts, the third time – for 120 seconds after 4 attempts and so on;
Don't blacklist blocked addresses
— when set, SBC does not send blocked addresses to the blacklist, the
«Progressive Block» option is ignored.