DoS Policy Quarantine Attacker

[Dopin]

Hi, Is there a way to " Quarantine" IP that hit DoS-Policy src-session threshold? It look like there are some external IP that are trying to brut force an SSH server that need to de worldwide accessible. As I understand, src-session only block connexion that are exceeding the specified threshold. Regards Dominic

[Dave_Hall]

Use the search link at the top of this page -- there are several posts, including examples on how to do this, such as one posted by edu. Also see his linked example.

[netmin]

a dos-policy can quarantine as well, example from 5.0.7:

 config firewall DoS-policy
  edit 0
   set interface " wan1" 
   set srcaddr " all" 
   set dstaddr " xyzserver" 
   set service " SSH" 
    config anomaly
     edit " tcp_src_session" 
      set status enable
      set log enable
      set action block
      set quarantine attacker
      set quarantine-expiry 1440 (1440 minutes = 24 hours)
      set quarantine-log enable
      set threshold 5
   next
  end
 end