Server connection detection

This help contains the following topics:

·     Introduction

·     Configure SCD

¡     Configure SCD learning

¡     Configure an SCD policy

Introduction

Server connection detection (SCD) enables the device to identify and classify legal and illegal connections initiated by given servers based on user-defined rules. This helps the administrators to monitor internal servers and prevent them from becoming part of a botnet and launching attacks or performing internal network penetration.

Configure SCD

SCD configuration involves the following tasks:

·     Configure SCD learning—Configure the device to learn connections initiated by given servers. The learning results provide the basis for administrators to create SCD policies to monitor and log illegal connections initiated by the servers.

·     Configure SCD policies—Create an SCD policy for a server and configure SCD rules to define the legal connections initiated by the server. The device can then log connections initiated by the server that do not match the SCD rules.

Configure SCD learning

Perform this task to enable the device to learn connections initiated by given servers.

Procedure

1.     Click the Policies tab.

2.     In the navigation pane, select Active Defense > Server Connection Detection.

3.     Click the SCD Learning tab.

4.     Enter the IP addresses of the servers for server-initiated connection learning and set the learning period.

5.     Click Start.

The device starts to learn the connections initiated by the specified servers for the specified learning period and displays the learning results in a list.

6.     To set a server-initiated connection as a legal connection, select the connection and click Create SCD rule.

The device automatically creates an SCD policy for the server and creates an SCD rule for the selected server connection in the policy.

Configure an SCD policy

Perform this task to create an SCD policy.

Procedure

1.     Click the Policies tab.

2.     In the navigation pane, select Active Defense > Server Connection Detection.

3.     Click the SCD Policy tab.

4.     Click Create.

5.     Create an SCD policy.

Table 1 SCD policy configuration items