# Configuring the Zone-based Defense Policy

After you create a Zone, configure a defense policy specifically for the Zone so that attack traffic can be blocked. When the Zone identifies abnormal traffic or is under attack, you can refer to the defense status information on the Versatile Security Manager (VSM) graphical user interface (GUI) to handle anomalies or attacks.

Choose Defense > Policy Settings > Zone. On the page that is displayed, you can manage the defense policies of the Zone. For details, see Table 1 and Table 2.

Table 1 Managing the defense policies of the Zone
Action | Description
--- | ---
Configure defense policies | Click of the Zone. For details, see Configuring a Defense Mode, Configuring a Zone Filter (AntiDDoS), and Configuring the Zone-based Defense Policy (AntiDDoS). For details about the defense policies of the AntiDDoS1820-N, see Configuring a Defense Mode, Configuring a Zone Filter (AntiDDoS1820-N/Netflow Detection), and Configuring a Zone Defense Policy (AntiDDoS1820-N/Netflow Detection).
Deploy | Policies configured for a Zone take effect only after they are deployed on associated devices. Select the check box of a Zone and click . For details, Deploying the Defense Policy.
Undeploy | Remove the policy configurations of a Zone from associated devices, but keep the configurations on the ATIC Management center. Select the check box of a Zone and click .
Handle anomalies or attack events | When a Zone identifies abnormal traffic or is under attack, State is Abnormal or Attacked. Click the state value of the State column of the Zone and perform appropriate operations. For details, see Handling Abnormal Events.

Table 2 Parameters of Zone policies
Parameter | Description
--- | ---
Zone | Indicates the Zone name defined when you create the Zone. For details, see Adding a Zone.
Type | Indicates the type of Zone.
Device Name | Indicates the detecting or cleaning device that provides anti-DDoS services for the Zone.
Baseline Learning | Indicates the state of the Zone-associated devices that perform baseline learning on traffic. Click the state value to configure the baseline learning task or view baseline learning results. For details, see Configuring the Baseline Learning.
State | Indicates the state of Zone traffic. Normal: The Zone traffic is normal or the Zone is not associated with any device. Abnormal: The Zone traffic does not comply with the normal model. That is, the traffic exceeds the threshold specified in the defense policy. Attacked: After traffic anomalies are detected on the cleaning device and the defense mechanism is enabled, the cleaning device starts to discard packets and the packet drop probability is higher than the specified value. If State of the Zone is Abnormal or Attacked, and Defense State is Not defended or Part Defended, click the state value in the State column. You can view the abnormal events and handle them. For details, see Handling Abnormal Events.
Defense State | Indicates the state that the cleaning device processes anomaly or attack traffic for the Zone. --: The Zone traffic is normal and no defense mechanism is required. Automatically Defended: The defense mechanism is automatically enabled for abnormal traffic. Not defended: The Zone traffic is abnormal, but the defense mechanism is not enabled for abnormal traffic. You need to manually enable the defense mechanism. Part Defended: The defense mechanism is manually enabled for part of abnormal traffic. Defended: The defense mechanism is manually enabled for all abnormal traffic. If State of the Zone is Abnormal or Attacked, and Defense State is Not defended or Part Defended, click the state value in the State column. You can view the abnormal events and handle them. For details, see Handling Abnormal Events.
Diversion State | NOTE: Only the AntiDDoS supports this operation. The AntiDDoS1820-N does not support this operation. Determines whether Zone traffic is diverted to the cleaning device. In diverting: All traffic diversion tasks in the Zone are enabled. Partial Diversion: The zone has multiple traffic diversion tasks. Some tasks are enabled, and some tasks are not enabled. Not diverted: The Zone has no traffic diversion tasks, or all traffic diversion tasks in the Zone are disabled. Confirmed Divert: When the device reports detected abnormal traffic to the ATIC, the ATIC generates traffic diversion tasks. After being confirmed by the administrator, the traffic diversion tasks will be delivered to the cleaning device. On the anti-DDoS network in off-line deployment, when one of the following states occurs, click the corresponding diversion state to check whether a traffic diversion task is created for the Zone or the traffic diversion task is enabled on the Traffic Diversion Task List tab page. For details, see Managing Traffic Diversion Tasks (ATIC). The diversion state of the Zone is Not diverted and the Zone state is Abnormal. The diversion state of the Zone is Partial Diversion and the Zone state is Abnormal. The diversions status of the Zone is Confirmed Divert and the Zone status is Normal.
Deployment State | Indicates the state whether the Zone policy is deployed on devices. The value can be Undeployed, Deploy Succeed, Part Deployed, or Deploy Failed. If Deployment is Deploy Failed, click Deploy Failed to view details on policy deployment and undeployment on the Zone-associated devices. If Deployment is Part Deployed, click Part Deployed to view the new policies that are not deployed on the Zone-associated devices.

- Configuring a Defense Mode
  A defense mode covers the traffic diversion mode, defense mode, dynamic blacklist mode, filter discard threshold, traffic limiting by destination IP, IP reputation and so on. Only the inbound traffic supports the defense mode. The outbound traffic does not.
- Filter
  This section describes how to configure a filter, which is used by the cleaning device to perform static filtering over the traffic destined for the Zone.
- Configuring a Location Policy
  A location policy can permit, block, or implement traffic limiting for traffic of a country.
- Creating a Blacklist
  After an untrusted source IP address is configured for the Zone in the blacklist, packets from the blacklisted source IP address are directly discarded.
- Creating a Whitelist
  After a trusted source IP address is configured for the Zone in the whitelist, packets from the whitelisted source IP address are directly forwarded.
- Configuring the Baseline Learning
  You can configure baseline learning to learn the traffic baseline values of the Zone to adjust defense thresholds in the defense policy.
- Configuring the Zone-based Defense Policy (AntiDDoS)
  After basic policies are configured, a basic attack defense policy is automatically generated on the devices associated with the Zone. You need to configure the attack defense policy based on live network traffic.
- Configuring a Zone Defense Policy (AntiDDoS1820-N/Netflow Detection)
  After the basic policy is configured, a basic defense policy is automatically generated on each associated device of the Zone to detect inbound traffic.
- Configuring Global Defense Policies
  This section describes how to configure global defense policies on the ATIC. Only the inbound traffic supports the defense mode. The outbound traffic does not.
- Cloud Cleaning
- Creating User-defined IP Locations
  If the IP location division granularities in the IP location database file cannot meet requirements, you can create user-defined IP locations. Only the inbound traffic supports user-defined IP locations. The outbound traffic does not.
- Library Files
  This section describes how to load and update the IP reputation database and region identification signature database.
- Information Collection
  This section describes the information collection function in common configurations. The AntiDDoS1820-N does not support this operation.
- Intelligent Defense Config
  The intelligent defense function supports intelligent identification of false and missed preventions.
- Configuring Policy Templates
  A policy template defines the defense policies of various types for an AntiDDoS1820-N or AntiDDoS device model to facilitate policy configurations.
- Deploying the Defense Policy
  The deployment operation enables configuration data on the ATIC Management center to be delivered to the AntiDDoS or AntiDDoS1820-N. Defense policies configured for the Zone take effect only after deployed on the AntiDDoS or AntiDDoS1820-N.
- Saving Configurations
  After a policy is configured, you can save configurations through the CLI or ATIC Management center.

Parent topic: Configuring Defense Policies (Inbound)

Copyright © Huawei Technologies Co., Ltd.