SANGFOR IAM v2.1 User Manual
94
same segment with IAM gateway device) will be blocked by the IAM gateway device. This [LAN
Router List] will prevent the MAC address of the LAN router (in the list) from being blocked by
the IAM gateway device.
You can enter interface IP address or MAC address of the router (or layer 3 switch) that directly
connects to the LAN interface of the IAM gateway device. The IAM gateway device will
automatically distinguish the MAC address of the corresponding IP address.
[Excluded IP List]: Configures the IP address(es) that will not be defended against in any case,
regardless of the number of connections and high frequency of sending packets. Generally, the
connections and frequency of sending packet of an IP address is limited; if any of the standards is
reached, it will be regarded as DoS attack.
[Max New TCP Connections Per IP]: Configures the maximum TCP connections of each IP
allowed by the IAM gateway device in one minute. If number of new TCP connections of an IP
address exceeds the limit configured herein, the IP will be blocked for a certain time ([Host
Blocking Time After Attack is Detected]).
[Max Attack Packets Per IP]: Configures the maximum packets (including SYN packets, ICMP
packets and TCP/UDP small attack packets) of each IP or MAC address allowed by the IAM
gateway device in one second. If number of them exceeds the limit configured herein, the IP or
MAC address will be blocked for a certain time ([Host Blocking Time After Attack is Detected]).
[Host Blocking Time After Attack is Detected]: Configures the time duration of blocking the host
if the IAM gateway device detects that this host is initiating attacks; in unit of minutes.
It is strongly recommended to enable the anti-DoS function, which will enable the IAM
gateway device to efficiently defend attacks initiated by external networks and to prevent
traffic congestion caused by enormous and continuous packets that are sent by the
virus-infected LAN PC.
[LAN Address List] is also recommended to be configured. This configuration will help to
defend against attacks initiated by masqueraded IP address. Better to add all the LAN
segments to the list, for the data packets sent by the IP addresses outside the list will be then
forwarded to the IAM gateway device and then be dropped.
If there is a LAN router or layer 3 switch, please DO add the routing device's interface IP