Radware Alteon, Инструкция по применению

Страница: 602 / 842

Alteon Application Switch Operating System Application Guide
Advanced Denial of Service Protection
602
Document ID: RDWR-ALOS-V2900_AG1302
4. When an attack pattern is matched, Alteon drops this packet, and creates a session so that
subsequent packets of the same session (if it is TCP) are also dropped without going through
additional rule inspection.
Other Types of Security Inspection
Alteon can use its inspection engine to provide rate limiting capability to complex protocols such as
those used in the peer-to-peer programs that use dynamic ports to establish communication
between clients. Standard firewalls are unable to detect these programs, because the protocol
signatures do not appear at the Layer 4 port level. Many of these protocols have signatures that are
embedded in the HTTP header or, in some cases, embedded in the data payload itself. For more
information, see
TCP or UDP Pattern Matching, page 618 .
Alteon can also rate limit the amount of the total traffic generated by these programs. This is
especially useful in Cable ISP and universities where peer-to-peer programs can reach as much as
70% of the total traffic. For more information, see
Protocol-Based Rate Limiting, page 611 .
IP Address Access Control Lists
Alteon can be configured with IP access control lists (ACLs) composed of ranges of client IP
addresses that are to be denied access to Alteon. When traffic ingresses Alteon, the client source or
destination IP address is checked against this pool of addresses. If a match is found, then the client
traffic is blocked.
ACLs versus Filters
ACLs are used to control which IP addresses are allowed access to a network. Unlike a filter, the IP
ACL feature can only perform a deny action. The decision about whether to deny traffic is based
solely on whether a match is found between the client IP and the ACL. The IP access control list
(
ipacl
) commands can be used to configure a pool of up to 8192 blockable IP addresses (5120
configured source IP addresses, 1024 configured destination IP addresses, 1024 operationally added
source IP addresses, and 1024 operationally added destination IP addresses).
While filters can perform the same function by blocking IP addresses ranges, they contain additional
information which also must be matched on ingress traffic before determining whether to allow,
deny, or redirect traffic.
How IP ACL Works
IP ACL uses a hash table to effectively block a configured range of IP addresses. The ACL is a global
list which is by default disabled. It is enabled on a per-port basis.
When a packet ingresses a port that has been enabled with IP ACK processing, Alteon compares the
client source or destination IP address with internal hash tables containing the IP addresses. If a
match is found, the packet is dropped. If no match on the address is found in any of the hash tables,
the packet is allowed to pass.