Zonedefense - D-Link NetDefendOS User Manual

Chapter 12: ZoneDefense
ZoneDefense Blocks Hosts or Networks Using Switches
ZoneDefense is a feature that can be used as a counter-measure to stop a threat-infected
computer in a local network from infecting other computers.
When hosts or clients in a network become infected with a virus or another form of threat, this
can often show its presence through anomalous behavior, such as large numbers of new
connections being opened to outside hosts. With the ZoneDefense feature, NetDefendOS can
automatically instruct a D-Link switch to block access to a host or network when such unusual
behavior is detected.
The ZoneDefense feature will only function with switches manufactured by D-Link and a list of
the supported switches is given later in this section.
ZoneDefense Makes Use of SNMP
Simple Network Management Protocol (SNMP) is an application layer protocol for complex
network management. SNMP allows the managers and managed devices in a network to
communicate with each other.
For ZoneDefense, NetDefendOS uses SNMP to control switch behavior. Management privileges
to a switch are gained by NetDefendOS using the configured SNMP Community String for write
access. The appropriate Management Information Base (MIB) file is then used by NetDefendOS to
determine how commands should be sent to a switch.
All relevant MIB files are already loaded into NetDefendOS but when configuring ZoneDefense,
NetDefendOS needs to be told which MIB to use. For older D-Link switches this is done by
specifying the exact switch product name. However, newer D-Link switches use a common
Universal MIB so the exact switch type need not to be specified.
Threshold Rules Can Trigger ZoneDefense
By setting up a NetDefendOS Threshold Rule, hosts or networks that are exceeding a defined
connection threshold can be dynamically blocked using the ZoneDefense feature. Thresholds are
Note: ZoneDefense is not available on all NetDefend models
The ZoneDefense feature is not available on the DFL-260E.
843