How does the Quarantine Action work; how long is a client that exceeds the threshold blocked?

Short answer

The Quarantine action counts the traffic of the client in the Tracking Time window according to the selected Tracking Key (IP, IP + User-agent, V-Host + IP, V-Host + IP + User-agent or Manual); when the Quarantine Condition is met, it writes the client to the quarantine table and applies the Quarantine Action (Silent Drop, Redirect or Show content) for the Quarantine Time. The default value of Quarantine time is 10 minutes; it is set between 1 second and 360 hours. When the time expires, the record drops from the table and access opens on its own; before the time expires, the client can be removed manually with Remove from Table on the Logs & Tracking screen of the vService.

How Does It Work?

Stage	What happens	Related field
Tracking	The metrics of the client are counted per key; the Conditions field determines in which traffic the tracking is done	Tracking Key (default IP) · Tracking Time (default 10 minutes)
Evaluation	The counter is compared with the threshold; the criteria can be combined with and / or	Quarantine Condition · criteria: HTTP requests, HTTP errors, Incoming data (B), Outgoing data (B), Total connections, Current connections (Tracking Criteria)
Quarantine	As long as the key stays in the table, all its requests are met with the action	Quarantine Time · Quarantine Action

• Quarantine Action options: Silent Drop (default; in HTTP, the connection is dropped without a response being given; in L7 TCP, the connection is refused), Redirect (always a 301 permanent redirect; the status code cannot be selected) and Show content (default status code 401 and the ready Quarantine page (English) content page).
• On an L7 TCP vService, Rule protocol = TCP is selected in the Details section of the action; the key can only be IP or Manual, the action can only be Silent Drop, and the HTTP-specific criteria (HTTP requests, HTTP errors) cannot be used.
• The traffic of a client in quarantine does not increase the tracking counter (quarantine behavior).
• If Hit Counter is on, the counter increases not during tracking but on every request to which the quarantine enforcement is applied; the value is seen on the Action Hits tab of the vService Dashboard.

How Long?

Mechanism	Duration field	Default	Range
LB Quarantine action	Quarantine time	10 minutes	1 second – 360 hours
LB Advanced CAPTCHA → Captcha quarantine	Quarantine duration	30 minutes	1 minute – 30 days (Captcha Quarantine)
Bot/DDoS Quarantine card	Quarantine duration	30 minutes	Quarantine Duration
AGS Bot Protection Policies → Block action	Block duration	5 minutes	30 seconds – 24 hours (actions)

In the LB Quarantine action, the time runs from the moment the client is written to the quarantine table; requests that arrive while the client is in quarantine are met with the action and do not extend the time (the end time is seen in the Quarantine Expiry column of the table). When the time expires, if the counter in the tracking window is still above the Quarantine condition threshold, the client is put into quarantine again on its next request.

How Is It Set Up?

1. With Load Balancer → Actions → Add, Action Type = Quarantine is selected (how to add).
2. Tracking Key, Tracking Time, Quarantine Condition (a new condition with +: Criteria = Quarantine condition), Quarantine Time and Quarantine Action are set and saved.
3. The action is selected in the Details → Actions field of the HTTP or L7 TCP vService, and the vService is saved.

Step-by-step example: Can I do rate limiting (X requests per second per IP)? · Quarantine table and manual removal: How do I see the clients in quarantine?

Common Misconceptions

• "Quarantine condition can also be used in another action." The Quarantine Condition condition is meaningful only inside the Quarantine action; if it is selected in another action, it is ignored.
• "The Conditions field also limits the quarantine." Conditions only selects the traffic in which the tracking is done; all the requests of a quarantined client are met with the action.
• "The quarantine is shared in the cluster." The configuration of the action goes to the peer device with auto-sync, but the tracking and quarantine records are kept separately on each device; they are preserved when the configuration is refreshed and reset when the service is restarted (collected data).
• "Tracking time and Quarantine time are the same thing." Tracking time is the window of the counter; Quarantine time is the duration of the block.

How it is done in the documentation

• Quarantine · How Does the Quarantine Action Work?
• Quarantine · Quarantine Time
• Quarantine Condition · Tracking Criteria

Related questions

• Can I do rate limiting (X requests per second per IP)?
• How do I see the clients in quarantine?
• Can I apply rate limiting based on a key such as an API key / token?