Limitations - D-Link NetDefend DFL-210 User Manual

12.3.4. Limitations

2. For Addresses choose the object name of the firewall's interface address 192.168.1.1 from the Available list
and put it into the Selected list.
3. Click OK
Configure an HTTP threshold of 10 connections/second:
1. Go to Traffic Management > Threshold Rules > Add > Threshold Rule
2. For the Threshold Rule enter:
• Name: HTTP-Threshold
• Service: http
3. For Address Filter enter:
• Source Interface: The firewall's management interface
• Destination Interface: any
• Source Network: 192.168.2.0/24 (or the object name)
• Destination Network: all-nets
4. Click OK
Specify the threshold, the threshold type and the action to take if exceeded:
1. Go to Add > Threshold Action
2. Configure the Theshold Action as follows:
• Action: Protect
• Group By: Host-based
• Threshold: 10
• Set the units for the threshold value to be Connections/Second
• Tick the Use ZoneDefense checkbox
• Click OK
12.3.4. Limitations
There are some differences in ZoneDefense operation depending on switch model. The first
difference is the latency between the triggering of a blocking rule to the moment when switch(es)
actually starts blocking out the traffic matched by the rule. All switch models require a short period
of latency time to implement blocking once the rule is triggered. Some models can activate blocking
in less than a second while some models may require a minute or more.
A second difference is the maximum number of rules supported by different switches. Some
switches support a maximum of 50 rules while others support up to 800 (usually, in order to block a
host or network, one rule per switch port is needed). When this limit has been reached no more hosts
or networks will be blocked out.
Important
ZoneDefense uses a range of the ACL rule set on the switch. To avoid potential
conflicts in these rules and guarantee the firewall's access control, it is strongly
recommended that the administrator clear the entire ACL rule set on the switch before
executing the ZoneDefense setup.
302
Chapter 12. ZoneDefense