Black List; Introduction To Black List - H3C SecPath F1800-A Operation Manual

Operation Manual - Security Defence
H3C SecPath F1800-A Firewall

2.6 Black List

2.6.1 Introduction to Black List

Black list is to filter packets based on source address. Compared with ACL-based
packet filter, the zones for black list to match are much simpler, so it can filter packets
in a high speed, which effectively shields the packets sent from the specific IP
address.
The most important feature of black list is that it can be added dynamically by the
firewall module. When firewall discovers the attack attempt of a specific IP address
based on the packet action, it can automatically modify its black list to filter all the
packets sent from the specific address. It is one of security features of the firewall.
I. Creating Black List
You can create black list in two ways:
creation through command lines
automatic creation by some modules of the firewall
1) Creation through command lines
You can use the following command to create a black list entry.
firewall blacklist sour-addr [ timeout minutes ]
Black list entry is created based on IP address. If the same IP address is configured in
the black list, the latter entry will replace the old one.
Without the parameter timeout minutes, a permanent entry is configured, that is, it
will not be aging. Otherwise, the blacklist entry will be removed automatically after the
aging time. As a result, the filtering on the packets from the IP address will be invalid.
2) Automatic creation by some modules of the firewall
Some modules of the firewall can dynamically insert an entry into the black list. For
instance, when the attack defence module discovers attack from a specific IP address,
it will automatically insert the specific IP address into the black list. Therefore, any
packet from the IP address will be denied in a specific period.
If the IP address to be inserted into the black list exists in the black list, the entry with
the longer aging time will be reserved.
So far, the following firewall modules can insert entries into the black list:
Attack defence module
IDS intrusion detect module
For the related configuration, refer to
section "Chapter 1 1.5 Log Maintenance" in
3.4 "Attack Defence and Packet Statistics"
"02-System Management
6-56
Chapter 2 Security Policy
and
Operation".