IP reputation configuration examples

 

The following information provides IP reputation configuration examples.

 

This document is not restricted to specific software or hardware versions. Procedures and information in the examples might be slightly different depending on the software or hardware version of the device.

The configuration examples were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.

The following information is provided based on the assumption that you have basic knowledge of the IP reputation feature.

 

The use of IP reputation requires a license. When the license expires, the existing IP reputation list is available but it cannot be upgraded.

If the IP reputation list update fails for 7 days consecutively, the device clears the IP reputation list and the IP reputation becomes unusable.

Network configuration

As shown in Figure 1, the device can access the cloud server on the Internet. Configure IP reputation to filter network traffic.

Figure 1 Network configuration

 

Software versions used

This configuration example was created and verified on F9345 of the F1060 device.

Procedure

1.     Assign IP addresses to interfaces:

# On the top navigation bar, click Network.

# From the navigation pane, select Interface Configuration > Interfaces.

# Click the Edit icon for GE 1/0/1.

# In the dialog box that opens, configure the interface:

a.     Select the Trust security zone.

b.     On the IPv4 Address tab, enter the IP address and mask of the interface. In this example, enter 10.1.1.1/24.

c.     Use the default settings for other parameters.

d.     Click OK.

# Add GE 1/0/2 to the Untrust security zone and assign 20.1.1.1/24 to it in the same way you configure GE 1/0/1.

2.     Configure settings for routing:

This example configures a static route.

# On the top navigation bar, click Network.

# From the navigation pane, select Routing > Static Routing.

# On the IPv4 Static Routing tab, click Create.

# In the dialog box that opens, configure a static IPv4 route to reach 0.0.0.0:

a.     Enter destination IP address 0.0.0.0.

b.     Enter mask length 0.

c.     Enter next hop address 20.1.1.2.

d.     Use the default settings for other parameters.

e.     Click OK.

3.     Create a security policy:

# On the top navigation bar, click Policies.

# From the navigation pane, select Security Policies > Security Policies.

# Click Create, and then click Create a policy.

# In the dialog box that opens, configure a security policy named trust-untrust to permit the specified traffic from the Trust to Untrust security zones:

¡     Enter policy name trust-untrust.

¡     Select source zone Trust.

¡     Select destination zone Untrust.

¡     Select type IPv4.

¡     Select action Permit.

¡     Use the default settings for other parameters.

# Click OK.

4.     Configure IP reputation:

# Click the Policies tab.

# From the navigation pane, select Threat Intelligence > IP Reputation.

# Select Enable for IP reputation.

# Select Enable for IP address hit statistics.

# Click Top hit statistics, configure statistics collecting conditions on the page that opens, and then click Start.

# Click Apply.

Figure 2 Configuring IP reputation

 

Verifying the configuration

View IP addresses with the most hits by clicking Top hit statistics to verify that the device filters network traffic based on the packet IP addresses. You can add IP addresses to or remove them from the blacklist or exception IP list.

To view detailed information about a hit IP address, click IP address search and enter the IP address on the page that opens.