D-Link DFL-260E User Manual for DFL-260E - Page 543
ZoneDefense with Anti-Virus Scanning, 12.3.5. Limitations, Anti-Virus Scanning
View all D-Link DFL-260E manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 543 highlights
12.3.4. ZoneDefense with Anti-Virus Scanning Chapter 12. ZoneDefense 2. For Addresses choose the object name of the firewall's interface address 192.168.1.1 from the Available list and put it into the Selected list. 3. Click OK Configure an HTTP threshold of 10 connections/second: 1. Go to: Traffic Management > Threshold Rules > Add > Threshold Rule 2. For the Threshold Rule enter: • Name: HTTP-Threshold • Service: http 3. For Address Filter enter: • Source Interface: The firewall's management interface • Destination Interface: any • Source Network: 192.168.2.0/24 (or the object name) • Destination Network: all-nets 4. Click OK Specify the threshold, the threshold type and the action to take if exceeded: 1. Go to: Add > Threshold Action 2. Configure the Theshold Action as follows: • Action: Protect • Group By: Host-based • Threshold: 10 • Set the units for the threshold value to be Connections/Second • Tick the Use ZoneDefense checkbox • Click OK 12.3.4. ZoneDefense with Anti-Virus Scanning ZoneDefense can be used in conjuction with the NetDefendOS Anti-Virus scanning feature. NetDefendOS can first identify a virus source through antivirus scanning and then block the source by communicating with switches configured to work with ZoneDefense. This feature is activated through the following ALGs: • HTTP - ZoneDefense can block an HTTP server that is a virus source. • FTP - ZoneDefense can block a local FTP client that is uploading viruses. • SMTP - ZoneDefense can block a local SMTP client that is sending viruses with emails. This feature is described further in Section 6.4, "Anti-Virus Scanning" and in the sections covering the individual ALGs. 12.3.5. Limitations There are some differences in ZoneDefense operation depending on switch model. The first difference is the latency between the triggering of a blocking rule to the moment when switch(es) 543