Cloud Firewall:Network traffic analysis FAQ

An application may be displayed as Unknown for the following reasons:

• A large amount of inbound traffic from the Internet may not use standard protocols. As a result, this traffic cannot be identified as a known protocol.

• The destination server may block network traffic and send many RST packets in response. These packets are recorded as outbound or inbound traffic. A high volume of these packets increases the percentage of Unknown traffic.

Intelligence tags are attributes that Cloud Firewall automatically assigns to outbound domains or destination IP addresses based on public network information. Examples include Malicious Download, Miner Pool, Threat Intelligence, First Time, epoch, Popular website, and DDoS Trojan. For more information about intelligence tags, see the Outbound Connection page.

• Cloud Firewall detects outbound activities that pose threats, including those related to Malicious Download, Miner Pool, and Threat Intelligence.

  Note

  Check the outbound connections associated with these tags for false positives. If you confirm the activity is malicious, configure an access control policy to manage it. For more information, see Configure an access control policy for the Internet firewall.

• First Time: Cloud Firewall detected the outbound activity for the first time.

• Periodic access: Your asset makes periodic outbound connections to this domain name or destination IP address.

• Popular website: A domain name that your server or service frequently accesses.

• DDoS Trojan: An outbound connection that Cloud Firewall detects as a DDoS attack threat.

When network traffic passes through Cloud Firewall, the following issues may occur:

• You cannot log on to the server.

• You cannot access services on the server.

• The server cannot access the Internet.

In Cloud Firewall, network traffic rules are matched in the following order:

1. Access control policy (ACL)
   If you enable access control, the system first matches traffic against your ACL rules:
   
   

   • If the traffic hits a rule with the Deny action, it is immediately blocked. No further checks are performed.

   • If the traffic hits a rule with the Allow or Monitor action, or if it does not hit any ACL rule, the system proceeds to the next check.

2. Threat Intelligence (TI)
   Matches traffic against the threat intelligence feed: 
   
   

   • If the traffic hits a rule and the action is Block, the matching process stops.

   • Otherwise, the system proceeds to the next check.

3. Intrusion Prevention System (IPS) module
   Traffic is processed sequentially by three types of rules: Basic Protection, Intelligent Defense, and Virtual Patching. These three rule types have no priority order, and the system evaluates all of them against the traffic. If any rule triggers a block action, the traffic is blocked; otherwise, the traffic is allowed after all evaluations are complete.