Limitations - D-Link NetDefend DFL-210 User Manual

12.3.4. Limitations

1. Go to Zone Defense > Exclude list
2. For Addresses choose the object name of the firewall's interface address 192.168.1.1 from the Available list
and put it into the Selected list.
3. Click OK.
Configure an HTTP threshold of 10 connections/second:
1. Go to Traffic Management > Threshold Rules > Add > Threshold Rule
2. For the Threshold Rule enter:
• Name: HTTP-Threshold
• Service: http
3. For Address Filter enter:
• Source Interface: The firewall's management interface
• Destination Interface: any
• Source Network: 192.168.2.0/24 (or the object name)
• Destination Network: all-nets
4. Click OK
Specify the threshold, the threshold type and the action to take if exceeded:
1. Go to Add > Threshold Action
2. Configure the Theshold Action as follows:
• Action: Protect
• Group By: Host-based
• Threshold: 10
• Set the units for the threshold value to be Connections/Second
• Tick the Use ZoneDefense checkbox
• Click OK
12.3.4. Limitations
There are some differences in ZoneDefense operation depending on switch model. The first differ-
ence is the latency between the triggering of a blocking rule to the moment when switch(es) actually
starts blocking out the traffic matched by the rule. All switch models require a short period of
latency time to implement blocking once the rule is triggered. Some models can activate blocking in
less than a second while some models may require a minute or more.
A second difference is the maximum number of rules supported by different switches. Some
switches support a maximum of 50 rules while others support up to 800 (usually, in order to block a
host or network, one rule per switch port is needed). When this limit has been reached no more hosts
or networks will be blocked out.
Important
ZoneDefense uses a range of the ACL rule-set on the switch. To avoid potential con-
flicts in these rules and guarantee the firewall's access control, it is strongly recom-
mended that the administrator clear the entire ACL rule-set on the switch before ex-
ecuting the ZoneDefense setup.
239
Chapter 12. ZoneDefense