Stormshield SN series Configuration Manual page 134

Destination
Destination object used as a selection criterion for the rule. Double-click in this zone to select the
associated value in a dedicated window. This window contains two tabs:
"General" tab
General
Destination hosts
Click on Ok to confirm your configuration.
"Geolocation/Reputation" tab
Geolocation
Select a region
Public IP address reputation
Select a reputation
category
Host reputation
Enable filtering based
on reputation score
Reputation score
Click on Ok to confirm your configuration.
"Advanced properties" tab
Advanced properties
Page 134/448
Select the destination host of the traffic from the object database in the drop-down
list. You can Add or Delete one or several objects by clicking on
object by clicking on .
This field allows applying the filter rule to destination hosts with a public IP address
belonging to countries, continents or geographic groups (group of countries and/or
continents -defined beforehand in the Objects > Network objects module).
This field allows applying the filter rule to destination hosts whose IP addresses have
been classified in one of the predefined reputation categories:
anonymizer: proxies, IPv4 to IPv6 converters.
l
botnet: infected hosts running malicious programs.
l
malware: hosts distributing malicious programs
l
phishing: compromised mail servers.
l
scanner: hosts that conduct port scanning or launch brute force attacks.
l
spam: compromised mail servers.
l
tor exit node: endpoint servers of the Tor network.
l
Bad: groups all of the above categories.
l
NOTE
Since the reputation of a public IP address may border on two categories
(botnet and malware), and this field only allows selecting one category, you
are advised to use the "Bad" group for optimum protection.
Select this checkbox in order to enable filtering based on the reputation score of hosts
on the internal network.
To enable host reputation management and to define the hosts concerned with the
calculation of a reputation score, go to the Application protection > Host reputation
module.
This field allows selecting the reputation score above which (
the filter rule will apply to the monitored destination hosts.
SNS - USER CONFIGURATION MANUAL V.3
sns-en-user_configuration_manual-v3 - Copyright © Stormshield 2016
FILTERING AND NAT
and Create an
) or below which ( )