This section is located at the network zone level. To create a new zone, use the following command:
Admin@nodename# create network zone
Provide the following zone parameters:
Parameter
|
Description
|
---|
name
|
Zone name.
|
description
|
Zone description.
|
dos-protection-syn
|
Protect the zone against network flooding for TCP protocol (SYN-flood):
-
enabled: enable/disable the protection.
-
aggregate:
-
alert-threshold: alert threshold; if the number of requests exceeds this value, the event is recorded in the system log.
-
drop-threshold: packet drop threshold; if the number of requests exceeds this value, UserGate drops packets and records this event in the system log.
-
excluded-ips: list of IP addresses of servers that should be excluded from protection.
|
dos-protection-udp
|
Protect the zone against network flooding for UDP protocol:
-
enabled: enable/disable the protection.
-
aggregate:
-
alert-threshold: alert threshold; if the number of requests exceeds this value, the event is recorded in the system log.
-
drop-threshold: packet drop threshold; if the number of requests exceeds this value, UserGate drops packets and records this event in the system log.
-
excluded-ips: list of IP addresses of servers that should be excluded from protection.
|
dos-protection-icmp
|
Protect the zone against network flooding for ICMP protocol:
-
enabled: enable/disable the protection.
-
-
alert-threshold: alert threshold; if the number of requests exceeds this value, the event is recorded in the system log.
-
drop-threshold: packet drop threshold; if the number of requests exceeds this value, UserGate drops packets and records this event in the system log.
-
excluded-ips: list of IP addresses of servers that should be excluded from protection.
|
enabled-services
|
Zone access control settings:
-
"Any ICMP": allow use of the ping command to a UserGate address.
-
SNMP: provides SNMP access to UserGate (UDP 161).
-
response-pages: permission to display Captive portal auth and block pages (TCP 80, 443, 8002).
-
rpc: control XML-RPC: enables API control of the product (TCP 4040).
-
ha: service required to combine multiple UserGate nodes into a cluster (TCP 4369, TCP 9000-9100).
-
VRRP: required for combining several UserGate nodes into a HA cluster (IP protocol 112).
-
"Admin Console": access to the management web console (TCP 8001).
-
DNS: provides access to the DNS proxy service (TCP 53, UDP 53).
-
"HTTP Proxy": access to the HTTP(S) proxy (TCP 8090).
-
"Authorization agent": server access required for Windows authorization agents and terminal servers (UDP 1813).
-
"SMTP Proxy": service to filter SMTP traffic for spam and viruses. Required only when publishing a mail server to the Internet.
-
"POP3 Proxy": service to filter POP3 traffic for spam and viruses. Required only when publishing a mail server to the Internet.
-
"CLI over SSH": access to server to manage it via CLI, port TCP 2200.
-
VPN: provides server access for connecting L2TP VPN clients (UDP 500, 4500).
-
SCADA: SCADA traffic filtering. Required only for SCADA traffic control.
-
"REVERSE PROXY": service required to publish internal resources using Reverse Proxy.
-
"PROXY PORTAL": service required to publish internal resources using an SSL VPN.
-
L7 DNS: DNS traffic detection at the application level.
-
L7 NTP: NTP traffic detection at the application level.
-
"SAML SERVER": select an SAML server in the list of zone services and general UserGate settings.
-
Log Analyzer: the Log Analyzer service. Enable this if you plan to use this UserGate server as a Log analyzer (TCP 2023 and 9713).
-
"Dynamic routing OSPF": OSPF dynamic routing service.
-
"Dynamic routing BGP": BGP dynamic routing service.
-
"SNMP Proxy": service used to build a distributed monitoring system (used to balance load and organize monitoring of a distributed network infrastructure).
-
"SSH Proxy": service used to initiate SSH traffic.
-
Multicast: multicast service.
-
NTP: access to the accurate time service running on the UserGate server.
-
"Dynamic routing RIP": RIP dynamic routing service.
-
UserID agent: a transparent authentication service. Active Directory log and Syslog are used as the authentication data source for that purpose.
-
BFD: the Bidirectional Forwarding Detection service for quick network fault detection.
|
service-addresses
|
Allowed IP addresses for services:
|
antispoof-enabled
|
Enable/disable IP spoofing protection:
|
antispoof-negate
|
Enumerated options:
If antispoof-negate on is enabled, the interfaces in that zone will not receive packets from the source addresses specified in the value ip-spoofing-networks. In this case packets with specified source IP addresses will be discarded.
|
sessions-limit-enabled
|
Enable the limit on the number of concurrent sessions from a single IP address:
|
sessions-limit-exclusions
|
Add a list of IP addresses to which the concurrent session limit will not apply.
|
sessions-limit-threshold
|
The maximum allowed number of sessions originating from a single IP address.
|
geoip
|
GeoIP codes that are used in IP spoofing protection.
|
ip-list
|
List of IP addresses that are used in IP spoofing protection.
|
Example command to create a zone:
Admin@nodename# create network zone name Test_zone description "Test_zone description" antispoof-enable on enabled-services [ "Any ICMP" DNS ] dos-protection-icmp enabled on
To edit zone parameters, use the following command:
Admin@nodename# set network zone <zone-name>
To edit zone parameters, use the following command:
Admin@nodename# set network zone Test_zone dos-protection-syn enabled on
To delete a zone or its parameters, use the following command:
Admin@nodename# delete network zone <zone-name>
You can delete the following parameters:
Parameter
|
Description
|
---|
dos-protection-syn
|
Protect the zone against network flooding for TCP protocol (SYN-flood):
|
dos-protection-udp
|
Protect the zone against network flooding for UDP protocol:
|
dos-protection-icmp
|
Protect the zone against network flooding for ICMP protocol:
|
enabled-services
|
The previously configured zone access control settings
|
geoip
|
GeoIP codes that are used in IP spoofing protection.
|
ip-list
|
List of IP addresses that are used in IP spoofing protection.
|
To preview zone settings, use the following command:
Admin@nodename# show network zone <zone-name>