Quarantine functions

[cwilliams]

I have  a customer who is familiar with ISS Proventias.  This customer is trying to match capabilities of the ISS to PA.   I have answered all his questiosn/ matchups with IPS rule to a Vulnerability Protection policy+ Malware/Spyware policy, but I am not sur ehow to address this quarantine question with him.

In the ISS Proventia, you can set a time limit to block traffic hitting an IPS rule, "quarantining" for a period of time.   I can't seem to find this capabiity in the actions, etc.

Please advise!

Thanks!

Cam

[mikand]

You mean like a ratelimiting but for the Threat Prevention functions?

IMHO that doesnt make sense... you want to allow bad traffic but block the bad traffic for lets say 5 minutes and then allow the bad traffic again?

Or could you perhaps describe the usercase in more detail?

[ekerstetter]

cwilliams, is this an example you are thinking of?

Say that the Firewall detects a port scan from a particular IP address. What some IPS devices do is block that all traffic from that IP address for a certain amount of time, say 10 minutes. Once that timer expires, traffic is then permitted from that IP, until anoher violation occurs.