topic Re: Quarantine functions in General Topics

Quarantine functions

cwilliams — Wed, 01 Feb 2012 17:10:42 GMT

I have a customer who is familiar with ISS Proventias. This customer is trying to match capabilities of the ISS to PA. I have answered all his questiosn/ matchups with IPS rule to a Vulnerability Protection policy+ Malware/Spyware policy, but I am not sur ehow to address this quarantine question with him.

In the ISS Proventia, you can set a time limit to block traffic hitting an IPS rule, "quarantining" for a period of time. I can't seem to find this capabiity in the actions, etc.

Please advise!

Thanks!

Cam

Re: Quarantine functions

mikand — Wed, 01 Feb 2012 19:11:01 GMT

You mean like a ratelimiting but for the Threat Prevention functions?

IMHO that doesnt make sense... you want to allow bad traffic but block the bad traffic for lets say 5 minutes and then allow the bad traffic again?

Or could you perhaps describe the usercase in more detail?

Re: Quarantine functions

ekerstetter — Thu, 02 Feb 2012 04:48:32 GMT

cwilliams, is this an example you are thinking of?

Say that the Firewall detects a port scan from a particular IP address. What some IPS devices do is block that all traffic from that IP address for a certain amount of time, say 10 minutes. Once that timer expires, traffic is then permitted from that IP, until anoher violation occurs.