Innoband 8860-C1, User Manual

Page: 60 / 128

Chapter 4: Configuration 59
Intrusion Detection
The gateway’s Intrusion Detection System (IDS) is used to detect hacker attacks and intrusion attempts
from the Internet. If the IDS function of the firewall is enabled, inbound packets are filtered and blocked
depending on whether they are detected as possible hacker attacks, intrusion attempts or other connections
that the gateway determines to be suspicious.
Blacklist : If the gateway detects a possible attack, the source IP or destination IP address will be added to
the Blacklist. Any further attempts using this IP address will be blocked for the time period specified as the
Block Duration . The default setting for this function is false (disabled). Some attack types are denied
immediately without using the Blacklist function.
Intrusion Detection : IDS will block Smurf attack attempts if enabled. Default is false.
Block Duration:
Victim Protection Block Duration : This is the duration for blocking Smurf attacks. Default value is
600 seconds.
Scan Attack Block Duration : This is the duration for blocking hosts that attempt a possible Scan
attack. Scan attack types include X’mas scan, IMAP SYN/FIN scan and similar attempts. Default
value is 86400 seconds.
DoS Attack Block Duration : This is the duration for blocking hosts that attempt a possible Denial
of Service (DoS) attack. Possible DoS attacks this attempts to block include Ascend Kill and
WinNuke . Default value is 1800 seconds.
Max TCP Open Handshaking Count : This is a threshold value to decide whether a SYN Flood attempt is
occurring or not. Default value is 100 TCP SYN per seconds.
Max PING Count : This is a threshold value to decide whether an ICMP Echo Storm is occurring or not.
Default value is 15 ICMP Echo Requests (PING) per second.
Max ICMP Count : This is a threshold to decide whether an ICMP flood is occurring or not. Default value is
100 ICMP packets per seconds except ICMP Echo Requests (PING).