What is Quarantine; how does it differ from blocking and where is it used in TR7?

Short answer

Quarantine is taking a source into a list for a certain time, not for a single request or packet: until the time expires, the same enforcement is applied to every request coming from that source, and the source does not need to be caught by a rule again. Blocking, on the other hand, stops only the request or packet caught by the rule. In TR7 quarantine is used in three places: in Bot/DDoS protection there is a single Quarantine card per vService (default time 30 minutes, default action Silent Drop) and the Reason column of the table shows which protection put the source there; in L4 DDoS protection, rules in Quarantine mode take the source into the quarantine list of the route table (Quarantine Time default 10 minutes); in Load Balancer, the Quarantine action holds, for the Quarantine Time duration, the source that matches the condition. The default first rule of IP Reputation Protection also sends the attacker categories to this Bot/DDoS Quarantine list.

Where It Is Used in TR7

Where	Field / label	What for
Bot/DDoS Management → Quarantine card	Tracking Type, Quarantine Duration, Quarantine Action	The common list used when Quarantine is selected as the action in L7 DDoS Protection, IP Reputation Protection and Bot Protection rules
Quarantine card → table	Reason column	The protection that put the source on the list; the source is released by deleting the row manually
Bot/DDoS Management → Captcha card	Quarantine Failed Captcha Solvers	Taking a source that repeatedly fails to solve the CAPTCHA into the same list
Left Monitor Panel → Route Tables & L4 DDoS → route table → L4 DDoS Management	Rule Status = Quarantine; Quarantine Time	Dropping, for the duration, all the new traffic in the route table from the source caught by the rule; the time is common to all the rules in the route table
Route table → Quarantine History	Reason column	The history of the L4 DDoS quarantine records
Load Balancer → Actions	Quarantine action: Quarantine Time, Quarantine Action	Taking the source that matches the condition into quarantine with a vService rule

Difference from Blocking

	Blocking (Block, Silent Drop)	Quarantine
Scope	The request or packet caught by the rule	All the requests of the source for the duration
Duration	Instant	Until the time expires
Subsequent requests	Each one is evaluated again by the rules	The same enforcement is applied without them needing to be caught by a rule
Removal	Ends when the rule condition disappears	Ends when the time expires or the record is deleted manually

Common Misconceptions

• "Quarantine is a permanent blacklist." When the time expires, the source leaves the list; for permanent blocking, IP reputation Blacklist Content or a conditional Block action is used.
• "All modules use a single quarantine list." The Bot/DDoS list is per vService, and the L4 DDoS list is per route table; the Load Balancer Quarantine action keeps its own list. A source taken into one of them does not automatically appear in the others.
• "Even in Monitor mode the source is taken into quarantine." In Monitor mode the rules only produce events; no record is added to the quarantine list.

How it is done in the documentation

• Bot/DDoS Quarantine · What Is Quarantine?
• L4 DDoS Quarantine · The Difference Between Quarantine and Block
• Quarantine action · How Does the Quarantine Action Work?

Related questions

• How does the Quarantine Action work; how long is a client that exceeds the threshold blocked?
• How do I see the clients in quarantine?
• What is the difference between the Standard, Tarpit and Silent Drop blocking types?