Managed Streams

Table 5–10: Rate Limited Streams Table (Continued)

 

 

Column

Definition

 

 

 

 

Security Zone (pair)

The Security Zone pair where the stream is rate limited (LAN -

 

WAN, for example)

 

 

Reason

The filter link that details why the traffic connection stream was

 

blocked. Click the link to display and manage the filter.

 

 

Search rate-limited streams

 

STEP 1

STEP 2

STEP 3

From the LSM menu, select Events > Managed Streams > Rate Limited Streams.

Enter search criteria for any of the following:

Protocol — The protocol for the connection: All, TCP, UDP, ICMP

Source or Destination Address — The traffic source or destination IP address

Source or Destination Port — The traffic source or destination IP port

Entering “0” or “0.0.0.0” in the fields you do not want to specify allows you to search on any of the four fields (combination or single).

Click Search.

To reset the search, click Reset.

Flush rate-limited streams

You can manually drop the connection for all or selected streams using the Flush functions available on the Rate Limited Streams page. A connection is automatically dropped when the connection table timeout period expires.

STEP 1

STEP 2

From the LSM menu, select Events > Managed Streams > Rate Limited Streams.

To drop all the connections, scroll to the bottom of the Rate Limited page. Then, click Flush All.

To drop selected connections, use the check box next to an entry to select it. Then, scroll to the bottom of the page and click Flush.

Quarantined Addresses

When traffic triggers an IPS filter configured with a Quarantine action set, the IP address of the host is quarantined. The host remains in quarantine with limited or no network access based on the settings configured in the quarantine action set, or until the address is manually removed from quarantine via the Quarantined Addresses page in the LSM, or until the global quarantine timeout (IPS > Preferences) expires.

Entries are added to the Quarantined Addresses page when the quarantine event occurs. Entries are automatically removed when the address is removed from quarantine either automatically based on the quarantine threshold settings for the action set, manually using the Remove function, or when the quarantine timeout expires.

X Family LSM User’s Guide V 2.5.1

113