Zonedefense; Overview; Zonedefense Switches - D-Link DFL-1600 User Manual

28.1

Overview

ZoneDefense is a feature in D-Link firewalls, which lets the firewall control
locally attached switches. This can be used as a countermeasure to stop a
worm-infected computer in the local network from infecting other
computers.
By setting up threshold rules on the firewall, hosts or networks that are
exceeding the defined threshold can be dynamically blocked out. The
thresholds are based on the number of new connections made per second by
either a single host or all hosts within a specified CIDR network range (an
IP address range specified by a combination of an IP address and its
associated network mask). When the firewall notices that a host or a
network has reached the specified limit, it uploads ACL (Access Control
List) rules to the switches, which in turn blocks all traffic for that host or
network. Blocked hosts and networks remain blocked until the system
administrator manually unblocks them using the firewall's Web or
command line interface.
28.2

ZoneDefense Switches

Switch information regarding every switch that is to be controlled by the
firewall has to be manually specified in the firewall configuration. The
information needed in order to control a switch includes:
28
293

ZoneDefense