Protecting An Ftp Server With An Alg - D-Link NetDefendOS User Manual

• A. Infected clients that need to be blocked.
• B. Infected servers that need to be blocked.
A. Blocking infected clients.
The administrator configures the network range to include the local hosts of the network. If a
local client tries to upload a virus infected file to an FTP server, NetDefendOS notices that the
client belongs to the local network and will therefore upload blocking instructions to the local
switches. The host will be blocked from accessing the local network and can no longer do any
harm.
Note: ZoneDefense will not block infected servers
If a client downloads an infected file from a remote FTP server on the Internet, the server
will not be blocked by ZoneDefense since it is outside of the configured network range.
The virus is, however, still blocked by the NetDefend Firewall.
B. Blocking infected servers.
Depending on the company policy, an administrator might want to take an infected FTP server
off-line to prevent local hosts and servers from being infected. In this scenario, the administrator
configures the address of the server to be within the range of the network to block. When a client
downloads an infected file, the server is isolated from the network.
The steps to setting up ZoneDefense with the FTP ALG are:
• Configure the ZoneDefense switches to be used with ZoneDefense in the ZoneDefense
section of the Web Interface.
• Set up the FTP ALG to use Anti-Virus scanning in enabled mode.
• Choose the ZoneDefense network in the Anti-Virus configuration of the ALG that is to be
affected by ZoneDefense when a virus is detected.
For more information about this topic refer to Chapter 12, ZoneDefense.
Example 6.3. Protecting an FTP Server with an ALG
An FTP Server is connected to a NetDefend Firewall on a DMZ and has a private IPv4, as
illustrated below. This example shows how to protect the server using an FTP ALG object.
440
Chapter 6: Security Mechanisms