Intrusion prevention

Prerequisites

Basic Protection on the Prevention Configuration page is turned on. Otherwise, Cloud Firewall cannot block traffic, record the traffic data, or display the data on the Intrusion Prevention page.

Overview

Limits

• Premium Edition, Enterprise Edition, and Ultimate Edition of Cloud Firewall support intrusion prevention. Free Edition of Cloud Firewall does not support this feature.
• The intrusion prevention feature of Cloud Firewall cannot parse the traffic that is encrypted by using SSL or Transport Layer Security (TLS). Therefore, this type of traffic cannot be detected or protected.

Internet Traffic Blocking

On the Internet Traffic Blocking tab, you can view the blocking events of inbound and outbound traffic from the last one hour, one day, seven days, one month, or a custom time range. You can specify a custom time range only within the last six months.

The Internet Traffic Blocking tab contains the following sections:

• Prevention Statistics: contains the Attack Statistics, Attack Distribution by Type, and Blocking Statistics widgets. The Blocking Statistics widget provides the following tabs:
  • Top Blocked Destination IP Addresses: displays the top 5 destination IP addresses that are most frequently used among the statistics on traffic blocked by Cloud Firewall.

    If you want to view the details about a blocked destination IP address, click the View Logs icon to go to the Log Audit page. In the log list, you can view the destination port and application type for the IP address, and the action that is performed on the IP address.

  • Blocking Criteria: displays the top 3 modules that are most frequently used by Cloud Firewall to block traffic.
  • Blocked Applications: displays the top 5 types of applications that are most frequently requested among the statistics on traffic blocked by Cloud Firewall.
• Detailed Data: displays the details about each traffic blocking event, including the risk level, number of times the event occurred, source IP address, and destination IP address.

  In the Detailed Data section, you can perform the following operations:

  • Specify conditions to search for events. The conditions include the risk level, module, traffic direction, and time range.
  • Find an event and click View Details in the Actions column to view the details about the event.
  • On the right of the search box, click the icon to download intrusion prevention policies. By default, you can download only the most recent 1,000 intrusion prevention policies. Excess policies cannot be downloaded.

VPC Traffic Blocking

On the VPC Traffic Blocking tab, you can view the information about unusual events on the traffic blocked between VPCs by Cloud Firewall. The information includes the name, risk level, and attack type. You can also specify a time range to view the information.