FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Basic

How do I see sources that were quarantined in the past by L4 DDoS and why (Quarantine History)? ​

Short answer

The Quarantine History tab of the route table lists every source quarantined by L4 DDoS Protection as a permanent log even after its duration expires: Date, IP (with the country flag), Country, the name of the rule that sent the source to quarantine (Reason), the threshold of the rule at that moment (Limit), the quarantine duration (Duration) and the release time (Released At) (columns). The screen opens with the records of the last 7 days; the range is changed with Time Range, the list does not refresh on its own and is reloaded with Get Logs. A row is written only on entry into quarantine; manual removal operations are recorded in User Logs. The records are also sent to the log destinations (SIEM) selected with Quarantine Log Forwarding. The ones that are in quarantine at that moment are seen in L4 DDoS Live View.

Problem: An Expired Quarantine Disappears from the Live Table ​

The quarantine table in L4 DDoS Live View shows only the sources that are in quarantine right now; a source whose quarantine duration (Quarantine Time, 10 minutes by default) expires drops from there. A permanent record is required to answer the question "Which addresses were quarantined last night, and because of which rule?", to find false positives or to examine an incident afterwards.

Solution: Two Methods ​

The two methods use the same quarantine entries; one displays them on the device, the other forwards them to external systems.

Your situationSuitable method
I want to see, filter and export past quarantines in the TR7 interfaceMethod 1: Quarantine History tab
I want to collect the quarantine records on a SIEM or syslog serverMethod 2: Quarantine Log Forwarding
I want to see and remove the sources that are in quarantine at that momentHow do I see the clients in quarantine?
  • How it works The device reads the quarantine lists of the route table every five seconds and writes a row for each source that was not present in the previous reading (when a record is created). A row is written only on entry into quarantine; the release time is in the Released At column of the same row.
  • Where it is opened Left Monitor Panel → Route Tables & L4 DDoS → route table → Quarantine History
  • RequirementL4 DDoS Protection (add-on); at least one L4 DDoS rule working in the Quarantine mode; the permission to view the route table
  • Scope The records of the opened route table; independent of the vService type

Step-by-Step Configuration ​

1
Adım 1 Open the Quarantine History tab

In the Left Monitor Panel, Route Tables & L4 DDoS is selected from the category tabs at the top left, the route table is clicked, and on the screen that opens, the Quarantine History tab is opened (access). The records of the last 7 days are loaded automatically.

2
Adım 2 Select the time range

A ready range (between 5 min and 3 months), Custom Duration or Custom Date Range is selected from the Time Range selector; its default value is Last 7 day(s). When the range changes, the records are reloaded.

3
Adım 3 Filter the records

In the Filter Strip, which comes open by default, the rule is selected from the Reason card, the country from the Country card, and the related value from the IP Tags or IP Version cards; in a cluster, there is also a Device card. The search box searches in all the columns.

4
Adım 4 Read the row

The Reason column shows the interface name of the rule that sent the source to quarantine, the Limit column shows the threshold of the rule at that moment (<value>/s in rate rules, <value> concurrent in connection rules, - in signature-based rules), Duration shows the quarantine duration and Released At shows the release time. The IP Version column is hidden by default; it is added from the Columns selector.

5
Adım 5 Refresh or export the list

To see the new entries that arrive while the screen is open, the Get Logs button is clicked. To get the list as Excel, CSV or PDF, the Export button is used (Export).

Verification ​

1Quarantine History listTR7 side

The address of a source seen in quarantine in Live View is searched for in Quarantine History.

ExpectedThe row of the source: Reason = the rule that sent it to quarantine, Released At = Date + Duration
Since the detection is done in five-second steps, Duration can appear a few seconds below the quarantine duration (e.g. 1h 59m for a 2-hour duration).

Method 2: Quarantine Log Forwarding ​

  • How it works Each entry written to Quarantine History is also sent to the selected Log Forwarding profiles; the message is in the <ip> quarantined (<rule>) format, and in the JSON and CEF formats the route table, IP, country, rule, threshold, duration and release time are carried as additional fields (Quarantine Log Forwarding).
  • Where it is openedL4 DDoS Management → Quarantine box → the pencil icon of the log forwarding sentence
  • Requirement At least one profile defined on the Settings → General Settings → Log Forwarding screen; the permission to make changes in the Network area
  • Scope At most 5 profiles per route table; at most 200 records per second to each destination

Step-by-Step Configuration ​

1
Adım 1 Open the forwarding window

In the L4 DDoS Management tab, the pencil icon to the right of the log forwarding sentence (Quarantine entries are not forwarded to a log destination) in the Quarantine box is clicked; the Rule Settings · Quarantine Log Forwarding window opens.

2
Adım 2 Select the log destinations

One or more Log Forwarding profiles are selected in the Quarantine Log Forwarding field (default: Nothing chosen). The Log Sources selection of the profile does not affect this forwarding.

3
Adım 3 Save

The Save button is clicked. The forwarding is applied to the quarantine entries from then on; no retroactive sending is done.

Verification ​

1Quarantine boxTR7 side

The log forwarding sentence is read.

ExpectedQuarantine entries are forwarded to <profile names>
2SIEM / syslog serverLog destination

After the next quarantine entry, the records that arrive at the destination are checked.

Expected<ip> quarantined (<rule>) · severity warning
In a heavy attack, the entries that exceed 200 records per second are not forwarded; at most once per minute, an "N quarantine entries were not forwarded in the last minute (they remain in the quarantine history)" summary is sent. The records continue to be in Quarantine History.

Common Mistakes ​

  • Expecting the release from quarantine to be written as a separate row too. The log records only the entries. Manual removal from Live View or emptying the list of a rule does not change the past row; Released At continues to show the planned time. These operations are seen on the User Logs screen.
  • Thinking the rules in the Block mode will also appear here. Quarantine History records only the sources that enter the quarantine lists; the packets dropped by a rule in the Block mode are seen not on this screen but in the Dropped Traffic tab of the Dashboard.
  • Thinking the color in the IP column shows the status at the moment of quarantine. The blacklist, whitelist and IP Tags color of the address belongs to the moment the screen was opened.
  • Thinking very short quarantines are recorded too. No row is created for a source that enters and leaves between two five-second readings; the sources that are already in the list when the device starts are also considered the initial state and are not written.
  • Searching for the records of all route tables on a single screen. The history is kept per route table; the screen shows only the records of the route table it was opened for. In a cluster, the records of the two devices are merged; the device that wrote the record appears in the Source column.

How it is done in the documentation

Related questions