Dynamic Defense; Table 16: Ucm6510 Firewall Dynamic Defense - Grandstream Networks UCM6510 User Manual

Dynamic Defense

Dynamic defense can blacklist hosts dynamically when the UCM6510 is set to "Route" under web GUI-
>Settings->Network Settings->Basic Settings: Method. If enabled, the traffic via TCP connection
coming into the UCM6510 can be monitored, which helps prevent massive connection attempts or brute
force attacks to the device. The blacklist can be created and updated by the UCM6510 firewall, which will
then be displayed in the web page. Please refer to the following table for dynamic defense options on the
UCM6510.
Dynamic Defense
Enable dynamic defense. The default setting is disabled.
Enable
Configure the dynamic defense periodic time interval (in minutes). If the number
Periodical Time of TCP connections from a host exceeds the "Connection Threshold" within this
Interval period, this host will be added into Blacklist. The valid value is between 1 and 59
when dynamic defense is turned on. The default setting is 59.
Configure the blacklist update time interval (in seconds). The default setting is
Blacklist Update 120. This defines how long the IP will be blocked once added into the UCM6510
Interval blacklist. For example, if it's set to 300 seconds, the blocked IP address will only
be able to establish TCP connection with the UCM6510 again after 300 seconds.
Configure the connection threshold. Once the number of connections from the
Connection
same host reaches the threshold during "Periodical Time Interval", it will be
Threshold
added into the blacklist. The default setting is 100.
Allowed IPs and ports range, multiple IP addresses and port range.
Dynamic Defense
For example,
Whitelist
192.168.5.100-
192.168.5.200 1500:2000
The following figure shows a configuration example like this:

If a host at IP address 192.168.5.7 initiates more than 20 TCP connections to the UCM6510 within 1
minute, it will be added into UCM6510 blacklist.

This host 192.168.5.7 will be blocked by the UCM6510 for 500 seconds.

Since IP range 192.168.5.100-192.168.5.200 is in whitelist, if a host initiates more than 20 TCP
connections to the UCM6510 within 1 minute, it will not be added into UCM6510 blacklist. It can still
establish TCP connection with the UCM6510.

Table 16: UCM6510 Firewall Dynamic Defense

UCM6510 IP PBX User Manual
P a g e | 72