Network

The Service Network page includes the following sections. Click on the link to go to the corresponding section to learn more:

• Network
  • • Blacklisted Source IPs
    • Network blocking bypass
      • Allowing IPs to bypass network controls
    • DoS mitigation
    • Attack source auto blocking
    • Network routing

To go to the documentation for the previous section of Services, see Global. To go to the documentation for next section in the manual, see Application Delivery Controller (ADC).

To manage website security profiles, under Services on the left panel, click Network.

To save configuration changes or edits you make to any features and options, you must click Save on the lower-right of the section or page where you are making changes. Click apply changes on the upper-left corner of the page, and then click OK. Your changes will not be stored if you do not properly save your changes.

Alert Logic Managed Web Application Firewall (WAF) can block hostile IP addresses at the network level. Addresses can be learned and automatically blocked in four ways:

• DoS Mitigation: If DoS Mitigation is enabled, source IPs exceeding configurable request limits are automatically blocked for a configurable number of seconds (i.e. 86400 - 24 hours).
• Attack source auto blocking: If Attack source auto blocking is enabled, source IPs are tracked across all website deny logs. If a number requests above a certain risk level are recorded within a certain time span, the source IP is automatically blocked for a configurable number of seconds.
• Immediate source blocking: Each website can be configured to immediately block a source IP if a log event above a certain risk level is recorded.
• Manual entry: IP addresses can be added manually to the list of blocked source IPs.

Only traffic to inbound interfaces is blocked. Management interfaces are not blocked unless the management role has been bound to an interface which is also responding to inbound requests - typically the interface facing the Internet.

Blocking a source IP does not keep a determined attacker from accessing your website. Positive filtering at the application level, which is the core functionality of WAF, is more effective at stopping unauthorized intrusion attempts. This forces the attacker to change IP every time he triggers an attack signature especially if immediate source blocking is enabled.

Blacklisted Source IPs

The table shows which source IPs are currently blocked.

Network blocking bypass

The table shows IP addresses which are allowed to bypass network protection like blacklisting and DoS mitigation controls.

Allowing IPs to bypass network controls

The network blocking bypass whitelist is compiled of:

• website Trusted Client IPs
• website trusted proxy IPs,
• the default gateway IP

Website Trusted Client lists

You can manage Trusted Client IP addresses in the Website global policy section of the Policy page.

To manage Trusted Client IP addresses:

1. In the left panel, under Services, click Websites to go to the Website page, and then click on the website for which you want to manage.
2. Under WAF, click Policy, and scroll down to the Website global policy section.
3. On the right of the Website global policy section, next to Display, ensure the drop-down option is on Advance.
4. Click + Trusted clients - IP whitelisting to expand the options in this feature.
5. In the Whitelist box, enter or remove any IP addresses with net mask (IP/mask) in CIDR notation separated by newline.
6. Select the Enable IP network blocking bypass for trusted client check box.

You must also enable network blocking bypass for trusted clients. Select the Allow website Trusted Client IPs to bypass network protection check box.

Website trusted proxies

You can add trusted proxies in the Client Source IP section of the Virtual host page.

To add trusted proxies:

1. From Websites page, click on the website you want to manage.
2. Under ADC, click Virtual host, and scroll to the Client Source IP Section.
3. Under the Trusted Proxy, select Use trusted proxy - extract client source IP from X-Forwarded-For header.
4. In the List of trusted proxies, enter or remove IP addresses with net mask (IP/mask) in CIDR notation separated by newline.

You must also enable network blocking bypass for trusted proxies. Select the Allow trusted proxy IPs to bypass network protection check box.

The default gateway

The default gateway is enabled by default.

DoS mitigation

When enabled the DoS mitigation system tracks source IP connections to inbound interfaces. If an IP exceeds the configurable limits it is added to the list of blocked IPs and further connection attempts are silently dropped at the network level.

Attack source auto blocking

Attack source auto blocking tracks denied source IPs at the application level and blocks an IP at the network level if they reach configurable limits.

Network routing

In some network deployments, you may want to have WAF perform routing functions by forwarding IP packets not destined for its own IP addresses. This allows these packets to pass between its interfaces. You must enable IP forwarding as a prerequisite when websites are deployed in routing proxy mode.

A segmentation matrix allows for configuring policy rules for forwarding IP packets between network interfaces.