Manual Cisco OL-6109-01

22 pages 0.11 mb
Download

Go to site of 22

Summary
  • Cisco OL-6109-01 - page 1

    CH A P T E R 4-1 Cisco Traffic Anomaly De tector User Guide OL-6109-01 4 Zone Configuration This chapter d escribes zone conf iguration. It includes the follo wi ng major sections: • Basic Zone Conf igu ration • Zone Remote Guard List • Zone T raf f ic Learning • Zone Detection Basic Zone Configuration This section describes t he initial Zo ...

  • Cisco OL-6109-01 - page 2

    Chapter 4 Z one Configuration Basic Zone Config uration 4-2 Cisco Traffic Anomaly Detector User Guide OL-6109-01 • Remov ing a Zone IP Addr ess • Remov ing all Zone IP Addresses Defining a New Zone The Detector enables the us er to define a ne w zone based on a v ariety of templates. T o defi ne a new zone perform the following: 1. From the Con ...

  • Cisco OL-6109-01 - page 3

    4-3 Cisco Traffic Anomaly De tector User Guide OL-6109-01 Chapter 4 Zone Configuration Basic Zone Configuration Note If no zone template is specif ied, the zone will be def ined using the Detector DEF A UL T zone template. – base-zone-name —(Optional) The name of a desired zon e used as a template for the ne w zone. – interactive —(Optional ...

  • Cisco OL-6109-01 - page 4

    Chapter 4 Z one Configuration Basic Zone Config uration 4-4 Cisco Traffic Anomaly Detector User Guide OL-6109-01 2. Choose ENTER . The following prompt appears: admin@DETECTOR–conf-zone-<new-zone-name># T o duplicate a zone from the zon e command group le vel perform the fol lowing: 1. From the Zone command g roup lev el of the desired zone ...

  • Cisco OL-6109-01 - page 5

    4-5 Cisco Traffic Anomaly De tector User Guide OL-6109-01 Chapter 4 Zone Configuration Basic Zone Configuration Removing All Zones The user may remov e all the Detector’ s zones. Caution Remov ing all zones eliminat es their DDoS detection. T o remov e all zones perform the follo wing: 1. From the Conf iguration command grou p lev el type the fol ...

  • Cisco OL-6109-01 - page 6

    Chapter 4 Z one Configuration Basic Zone Config uration 4-6 Cisco Traffic Anomaly Detector User Guide OL-6109-01 Where: – template-name —A zone template. Opti ons include: Default —The Guard default zone template LINK_128K —A template design ed for bandwidth-limi ted Links LINK_1M —A template designed for bandwidth-limit ed Links LINK_4M ...

  • Cisco OL-6109-01 - page 7

    4-7 Cisco Traffic Anomaly De tector User Guide OL-6109-01 Chapter 4 Zone Configuration Basic Zone Configuration Where zone-name specif ies the desired zone name. 2. Choose ENTER . Belo w is an example of the zone command implementation: admin@DETECTOR-conf# zone scannet admin@DETECTOR-conf-zone-scannet# Describing a Zone The user may add a descript ...

  • Cisco OL-6109-01 - page 8

    Chapter 4 Z one Configuration Basic Zone Config uration 4-8 Cisco Traffic Anomaly Detector User Guide OL-6109-01 – ip-mask —(Optional) The zone IP subnet mask. Note If no mask is specified, the D etector assum es the default su bnet mask 255.255.255.255 . 2. Choose ENTER . Below is an e xample of the ip address command implemen tatio n: admin@D ...

  • Cisco OL-6109-01 - page 9

    4-9 Cisco Traffic Anomaly De tector User Guide OL-6109-01 Chapter 4 Zone Configuration Zone Remote Guard List Note If no mask is specified, the D etector assum es the default su bnet mask 255.255.255.255 . 2. Choose ENTER . Below is an e x ample of the no ip address command implemen tatio n: admin@DETECTOR-conf-zone-scannet# no ip address 192.168.1 ...

  • Cisco OL-6109-01 - page 10

    Chapter 4 Z one Configuration Zone Remote Gu ard List 4-10 Cisco Traffic Anomaly Detector User Guide OL-6109-01 This section contains the follo w ing procedures: • Adding a Guard to the Zo ne Remote Guard List • Removing a Guard from the Zone Remote Guard List • Interacti ve Recommendations Mo de Adding a Guard to the Zone Remote Guard List T ...

  • Cisco OL-6109-01 - page 11

    4-11 Cisco Traffic Anomaly De tector User Guide OL-6109-01 Chapter 4 Zone Configuration Zone Remote Guard List Where remote-guard-a ddress specifies the remote Guard IP address. Use ‘*’ to remo ve all remot e Guards from the remo te Guard list. Caution The user should verify that the Detector has at least one remote Guard on its defaul t remote ...

  • Cisco OL-6109-01 - page 12

    Chapter 4 Z one Configuration Zone Traffic Learning 4-12 Cisco Traffic Anomaly Detector User Guide OL-6109-01 T o create a ne w zone with interacti ve recommendations mod e perform the follo wing: 1. From the Conf iguration command grou p lev el type the follo wing: admin@DETECTOR-conf# zone < new-zone-name > interactive 2. Choose ENTER . The ...

  • Cisco OL-6109-01 - page 13

    4-13 Cisco Traffic Anomaly De tector User Guide OL-6109-01 Chapter 4 Zone Configuration Zone Traffic Le arning The Detector’ s too ls for constructing detection policies are the Polic y T empl a tes. These define the policies according to the Minimum Threshold and Maximum Services parameters the user pro vides (t his chapter will not cov er those ...

  • Cisco OL-6109-01 - page 14

    Chapter 4 Z one Configuration Zone Traffic Learning 4-14 Cisco Traffic Anomaly Detector User Guide OL-6109-01 Where zone-name specifies a zone name. Note that the Guard enables the use of an asteri sk (*) as a wildcard denoting either of the follo wing option s: – All of the Guard’ s zones. Issuing learning pol icy-construction* means setting t ...

  • Cisco OL-6109-01 - page 15

    4-15 Cisco Traffic Anomaly De tector User Guide OL-6109-01 Chapter 4 Zone Configuration Zone Traffic Le arning Accepting Learning Phase 1 – Policy Construction The user may accept the Detector’ s suggested pol icies. T o accept the results of the initial Po licy Construction phase perform the follo wing: 1. From the Global command group lev el ...

  • Cisco OL-6109-01 - page 16

    Chapter 4 Z one Configuration Zone Traffic Learning 4-16 Cisco Traffic Anomaly Detector User Guide OL-6109-01 Note that the Detector enable s the us e of an asterisk (*) as a wildcard denoting either o f the follow ing options: – All of the Detector’ s zones. Issuing no lear ning* reject means aborting the learning phase fo r all of the Detecto ...

  • Cisco OL-6109-01 - page 17

    4-17 Cisco Traffic Anomaly De tector User Guide OL-6109-01 Chapter 4 Zone Configuration Zone Traffic Le arning Terminating Learning Phase 2 – Threshold Tuning After a suf ficie nt period of time (see the abo ve note) the user ends the Threshold T uning phase. The u s er may accept th e Detect or’ s suggested policies or decide to abort the seco ...

  • Cisco OL-6109-01 - page 18

    Chapter 4 Z one Configuration Zone Traffic Learning 4-18 Cisco Traffic Anomaly Detector User Guide OL-6109-01 Aborting Learning Phas e 2 – Tuning Threshold The user may wish to abort the second phase of learning procedure. In this case the Detector stops the process and erases the data learned on the se cond phase. The data gathered on the first ...

  • Cisco OL-6109-01 - page 19

    4-19 Cisco Traffic Anomaly De tector User Guide OL-6109-01 Chapter 4 Zone Configuration Zone Detection 2. Choose ENTER . The follo wing (partial sample) scr een appears: admin@DETECTOR-conf-zone-scannet# show policies statistics Key Rate Policy 192.168.100.34 73.17 http/80/analysis/syns/dst_ip N/A 0.17 http/80/analysis/syns/global Key Ratio Policy ...

  • Cisco OL-6109-01 - page 20

    Chapter 4 Z one Configuration Zone Detection 4-20 Cisco Traffic Anomaly Detector User Guide OL-6109-01 Note that the Detector enable s the us e of an asterisk (*) as a wildcard denoting either o f the follow ing options: – All of the Detector’ s zones. Issuing detect * means be ginning detection for all of the Detector’ s zones. – A wildcar ...

  • Cisco OL-6109-01 - page 21

    4-21 Cisco Traffic Anomaly De tector User Guide OL-6109-01 Chapter 4 Zone Configuration Zone Detection Where: – all-zone —The Detector activ ates the Guard to assume protection ov er the ov erall z one whenev er a traff ic abnormality is detected (see this section’ s e xplanation for further details). – only-dest-ip —The Detector acti v a ...

  • Cisco OL-6109-01 - page 22

    Chapter 4 Z one Configuration Zone Detection 4-22 Cisco Traffic Anomaly Detector User Guide OL-6109-01 The sample screen indicates that zone tr aff ic is mirrored (or split), the Detector recei ves the zone’ s traf f i c and the traf fi c sho ws normal flow fluctuatio ns. Zone detection is fun ctioning properl y . Ending the Zone Detection The us ...

Manufacturer Cisco Category Computer Hardware

Documents that we receive from a manufacturer of a Cisco OL-6109-01 can be divided into several groups. They are, among others:
- Cisco technical drawings
- OL-6109-01 manuals
- Cisco product data sheets
- information booklets
- or energy labels Cisco OL-6109-01
All of them are important, but the most important information from the point of view of use of the device are in the user manual Cisco OL-6109-01.

A group of documents referred to as user manuals is also divided into more specific types, such as: Installation manuals Cisco OL-6109-01, service manual, brief instructions and user manuals Cisco OL-6109-01. Depending on your needs, you should look for the document you need. In our website you can view the most popular manual of the product Cisco OL-6109-01.

Similar manuals

A complete manual for the device Cisco OL-6109-01, how should it look like?
A manual, also referred to as a user manual, or simply "instructions" is a technical document designed to assist in the use Cisco OL-6109-01 by users. Manuals are usually written by a technical writer, but in a language understandable to all users of Cisco OL-6109-01.

A complete Cisco manual, should contain several basic components. Some of them are less important, such as: cover / title page or copyright page. However, the remaining part should provide us with information that is important from the point of view of the user.

1. Preface and tips on how to use the manual Cisco OL-6109-01 - At the beginning of each manual we should find clues about how to use the guidelines. It should include information about the location of the Contents of the Cisco OL-6109-01, FAQ or common problems, i.e. places that are most often searched by users in each manual
2. Contents - index of all tips concerning the Cisco OL-6109-01, that we can find in the current document
3. Tips how to use the basic functions of the device Cisco OL-6109-01 - which should help us in our first steps of using Cisco OL-6109-01
4. Troubleshooting - systematic sequence of activities that will help us diagnose and subsequently solve the most important problems with Cisco OL-6109-01
5. FAQ - Frequently Asked Questions
6. Contact detailsInformation about where to look for contact to the manufacturer/service of Cisco OL-6109-01 in a specific country, if it was not possible to solve the problem on our own.

Do you have a question concerning Cisco OL-6109-01?

Use the form below

If you did not solve your problem by using a manual Cisco OL-6109-01, ask a question using the form below. If a user had a similar problem with Cisco OL-6109-01 it is likely that he will want to share the way to solve it.

Copy the text from the picture

Comments (0)