Contents

Configuring domain reputation· 1

About domain reputation· 1

Domain reputation workflow· 1

Restrictions and guidelines: Domain reputation· 2

Restrictions: Licensing requirements for domain reputation· 3

Domain reputation tasks at a glance· 3

Enabling domain reputation globally· 3

Specifying actions for an attack category· 3

Specifying an exception domain name· 4

Enabling cloud query for domain reputation· 4

Managing the domain reputation signature library· 5

Restrictions and guidelines· 5

Scheduling automatic domain reputation signature library update· 5

Triggering an immediate domain name signature update· 6

Performing an domain name signature manual update· 6

Enabling the top hit ranking feature· 7

Deleting the domain reputation signature library· 7

Display and maintenance commands for domain reputation· 7

Domain reputation configuration examples· 8

Example: Configuring domain reputation· 8

 

Configuring domain reputation

About domain reputation

Domain reputation

The domain reputation feature uses domain names on the domain reputation signature library and cloud query to filter network traffic. The device enabled with the domain reputation feature can control network access behaviors of the users.

Domain reputation signature library

The signature library contains domain names with poor reputation, which are vulnerable to DDoS attacks, command injection attacks, Trojan virus download attacks, and port scan attacks. The signature library also contains the attack category and other attribute information for the domain name.

Cloud server

The cloud server provides domain reputation cloud query to expand the locally loaded domain reputation signature library. When the library cannot match the domain information in packets, domain reputation cloud query is used to send the domain information to the cloud server for inspection. After the cloud server completes the inspection, it sends the results to the device. Then, the device stores the results in the local domain reputation cache for subsequent packet matching without the need to send queries to the cloud server.

Local domain reputation

Local domain reputation includes the domain reputation signature library loaded on the device and the historical query results from the cloud server, also known as the local domain reputation cache.

Domain reputation workflow

Figure 1 describes the domain reputation workflow.

Figure 1 domain reputation workflow

‌

After receiving a packet, the device performs the following operations:

1.     Determines whether the domain name of the DNS request packet matches an exception domain name.

¡     If a match is found, the device forwards the packet.

¡     If no match exists, the device proceeds to the next step.

2.     Determines whether the domain name matches a domain name on the local domain reputation.

¡     If a match is found and the domain name belongs to only one attack category, the device takes the actions in this attack category.

¡     If a match is found and the domain name belongs to multiple attack categories, the device takes an action that has higher priority among all actions in those attack categories.

The device supports the following actions:

-     Permit—Allows packets to pass through.

-     Drop—Drops packets.

-     Logging—Generates domain reputation logs for the matching domain name.

¡     If no match is found, the device identify whether cloud query is enabled.

-     If cloud query is enabled, the device permits the packet to pass through and send domain information to the cloud server. The device will store the query results returned from the cloud server to the local domain reputation cache for subsequent domain reputation matching without further query from the cloud server.

-     If cloud query is disabled, the device permits the packet to pass through.

Restrictions and guidelines: Domain reputation

The NSQM1FWEFGA0 service module does not support domain reputation.

Restrictions: Licensing requirements for domain reputation

The domain reputation feature requires a license to run on the device. If the license expires, you can still use the domain reputation feature but you can no longer upgrade the domain reputation signature library on the device or use the cloud query feature. For more information about licenses, see license management in Fundamentals Configuration Guide.

Domain reputation tasks at a glance

To configure domain reputation, perform the following tasks:

1.     Enabling domain reputation globally

2.     Specifying actions for an attack category

3.     (Optional.) Specifying an exception domain name

4.     (Optional.) Enabling cloud query for domain reputation

5.     Managing the domain reputation signature library

6.     (Optional.) Enabling the top hit ranking feature

Enabling domain reputation globally

About this task

This feature identifies packets based on the domain name on the reputation signature library and processes the matching packets based on the attack category of the domain name.

Procedure

1.     Enter system view.

system-view

2.     Enter domain reputation view.

domain-reputation

3.     Enable domain reputation globally.

global enable

By default, domain reputation is disabled globally.

Specifying actions for an attack category

About this task

On the domain reputation list, a domain name can belong to multiple attack categories. Each attack category has its own actions.

If a domain name belongs to only one attack category, the device takes the actions in this attack category. If a domain name belongs to multiple attack categories, the device takes an action that has higher priority among all actions in those attack categories. The drop action has higher priority than the permit action.

If logging is enabled for one of attack categories to which a domain name belongs, the device generates a log when the domain name is matched.

The device supports fast output of domain reputation logs. For more information about fast log output, see fast log output configuration in Network Management and Monitoring Configuration Guide.

Procedure

1.     Enter system view.

system-view

2.     Enter domain reputation view.

domain-reputation

3.     Specify actions for an attack category.

attack-category attack-id { action { deny | permit } | logging { disable | enable } } *

By default, no actions are configured for an attack category and the device takes the default action for the matching events in the domain reputation library.

Specifying an exception domain name

About this task

If you trust some domain names and do not want the device to perform domain reputation inspection on them, you can configure those domain names as exceptions.

The device forwards a DNS packet if the domain name of the packet is an exception domain name.

Restrictions and guidelines

When the device matches a domain name extracted from a DNS packet with an exception domain name, the device neither runs the domain reputation service nor performs DGA detection on that DNS packet. For more information about DGA detection, see DGA detection configuration in DPI Configuration Guide.

Procedure

1.     Enter system view.

system-view

2.     Specify an exception domain name.

inspect domain-name exception domain-name

By default, no exception domain name is specified.

For more information about this command, see DPI Command Reference.

Enabling cloud query for domain reputation

About this task

Domain reputation cloud query enhances the device ability to detect risks such as DDoS attacks, Trojan downloads, and port scans. When the device's loaded domain reputation signature library is insufficient or the signature library is not loaded, you can enable cloud query to enhance domain reputation inspection capabilities on the device.

After domain reputation cloud query is enabled, the device will encapsulate the source and destination IP addresses of the packets that fail to match the local domain reputation signature library into query packets. Then, the query packets are sent to the cloud server for inspection. When the cloud server completes the query, it sends the results back to the device. The query results include the following information:

·     Whether an IP address is flagged for risks such as DDoS attacks, Trojan downloads, and port scans.

·     Attack category to which a risk belongs.

Restrictions and guidelines

Before you configuring this feature, make sure the cloud server for reputation services is connected. You can access the cloud server page on the Web interface to obtain the connection status of the cloud server for reputation services. For more information about how to configure the cloud server for reputation services, see "Configuring DPI engine."

Procedure

1.     Enter system view.

system-view

2.     Enter domain reputation view.

domain-reputation

3.     Enable cloud query for domain reputation.

cloud-query enable

By default, cloud query is disabled for domain reputation.

Managing the domain reputation signature library

Restrictions and guidelines

·     Do not delete the /dpi/ folder in the root directory of the storage medium.

·     Do not perform update of the domain reputation signature library when the device's free memory is below the normal state threshold. For more information about device memory thresholds, see device management in Fundamentals Configuration Guide.

·     For successful automatic and immediate signature library update, make sure the device can resolve the domain name of the company's website into an IP address through DNS. For more information about DNS, see DNS configuration in Layer 3—IP Services Configuration Guide.

·     Update only one signature library at a time. Do not perform signature library update until the existing signature library update is completed.

Scheduling automatic domain reputation signature library update

About this task

You can schedule automatic domain reputation signature library update if the device can access the signature database services on the official website to update its local signature library according to the update schedule.

Procedure

1.     Enter system view.

system-view

2.     Enable automatic update of the domain reputation signature library and enter automatic domain reputation signature library update configuration view.

domain-reputation signature auto-update

By default, automatic update of the domain reputation signature library is disabled.

3.     Schedule the update time.

update schedule { daily | weekly { fri | mon | sat | sun | thu | tue | wed } } start-time time tingle minutes

By default, the device starts updating the domain reputation signature library at a random time between 01:00:00 and 03:00:00 every day.

Triggering an immediate domain name signature update

About this task

Anytime you find a release of new signature library version on the official website, you can trigger the device to immediately update the local signature library.

After you execute this command, the device immediately starts the automatic update process of the domain reputation signature library no matter whether or not automatic signature library update is enabled. The device automatically backs up the current signature library before overwriting it.

Procedure

1.     Enter system view.

system-view

2.     Trigger an immediate domain reputation signature library update.

domain-reputation signature auto-update-now

Performing an domain name signature manual update

About this task

If the device cannot access the signature database services on the official website, use one of the following methods to manually update the domain reputation signature library on the device:

·     Local update—Updates the domain reputation signature library by using a locally stored domain reputation signature library file. To use this method, first obtain the signature library file from the official website and import it to the device.

(In standalone mode.) Store the update file on the active MPU for successful signature library update.

(In IRF mode.) Store the update file on the global active MPU for successful signature library update.

·     FTP/TFTP update—Updates the domain reputation signature library by using the file stored on an FTP or TFTP server.

To specify the source IP address of request packets to the TFTP or FTP server for manual signature library update, specify the source keyword in the domain-reputation signature update command. For example, if packets from the device must be translated by NAT before accessing the TFTP or FTP server, you must specify a source IP address complied with NAT rules for NAT translation. If NAT translation is performed by an independent NAT device, make sure the IP address specified by the domain-reputation signature update command can reach the NAT device at Layer 3.

Restrictions and guidelines

If you specify both source and vpn-instance in the domain-reputation signature update command, make sure the VPN instance to which the specified source IP or interface belongs is the same as that specified by the vpn-instance keyword.

Procedure

1.     Enter system view.

system-view

2.     Manually update the domain reputation signature library on the device.

domain-reputation signature update file-path [ vpn-instance vpn-instance-name ] [ source { ip | ipv6 } { ip-address | interface interface-type interface-number } ]

Enabling the top hit ranking feature

About this task

This feature enables the device to collect hit statistics for domain names on the domain reputation signature library and rank them. After you disable this feature, the device clears hit statistics for domain reputation.

Procedure

1.     Enter system view.

system-view

2.     Enter domain reputation view.

domain-reputation

3.     Enabling the top hit ranking feature.

top-hit-statistics enable

By default, the top hit ranking feature is disabled.

Deleting the domain reputation signature library

About this task

If the memory on the device is insufficient or the current domain reputation signature library is unnecessary, you can delete the domain reputation signature library of the current version to free up memory space.

Procedure

1.     Enter system view.

system-view

2.     Delete the domain reputation signature library.

domain-reputation signature rollback factory

Display and maintenance commands for domain reputation

Execute display commands in any view.

‌

Task	Command
Display information about attack categories for domain reputation.	display domain-reputation attack-category
Display information about domain reputation signature library	display domain-reputation signature library
Display statistics for domain names with the highest hits on the domain reputation list.	In standalone mode:‌ display domain-reputation top-hit-statistics [ top-number ] [ slot slot-id [ cpu cpu-nunmber ] ] In IRF mode: display domain-reputation top-hit-statistics [ top-number ] [chassis chassis-number slot slot-id [ cpu cpu-nunmber ] ]
Display domain reputation information about a domain name.	display domain-reputation domain domain-name

‌

Domain reputation configuration examples

Example: Configuring domain reputation

Network configuration

As shown in Figure 2, the device connects to the LAN and Internet through security zones Trust and Untrust, respectively. Configure domain reputation on the device to control the illegal domain name requests of various departments.

Figure 2 Network diagram

‌

Procedure

1.     Assign IP addresses to interfaces:

# Assign an IP address to interface GigabitEthernet 1/0/1.

<Device> system-view

[Device] interface gigabitethernet 1/0/1

[Device-GigabitEthernet1/0/1] ip address 192.168.1.1 255.255.255.0

[Device-GigabitEthernet1/0/1] quit

# Assign IP addresses to other interfaces in the same way. (Details not shown.)

2.     Configure settings for routing.

This example configures a static route to reach the Web server, and the next hop in the route is 2.2.2.2.

[Device] ip route-static 5.5.5.0 24 2.2.2.2

3.     Add interfaces to security zones.

[Device] security-zone name trust

[Device-security-zone-Trust] import interface gigabitethernet 1/0/1

[Device-security-zone-Trust] quit

[Device] security-zone name untrust

[Device-security-zone-Untrust] import interface gigabitethernet 1/0/2

[Device-security-zone-Untrust] quit

4.     Configure a security policy:

# Enter IPv4 security policy view. Create a rule named trust-untrust to allow the internal users to access the Internet.

[Device] security-policy ip

[Device-security-policy-ip] rule name trust-untrust

[Device-security-policy-ip-10-trust-untrust] source-zone trust

[Device-security-policy-ip-10-trust-untrust] source-ip-subnet 192.168.1.0 24

[Device-security-policy-ip-10-trust-untrust] destination-zone untrust

[Device-security-policy-ip-10-trust-untrust] action pass

[Device-security-policy-ip-10-trust-untrust] quit

# Activate rule matching acceleration.

[Device-security-policy-ip] accelerate enhanced enable

[Device-security-policy-ip] quit

5.     Configure domain reputation:

# Enable domain reputation.

[Device] domain-reputation

[Device-domain-reputation] global enable

# Enable the top hit ranking feature.

[Device-domain-reputation] top-hit-statistics enable

# Specify actions deny and logging for attack category 1.

[Device-domain-reputation] attack-category 1 action deny logging enable

Verifying the configuration

# Verify that the device drops packets that match attack category 1 and generates logs for domain names that are matched. You can view the top hit ranks for IP addresses on the domain reputation list on the Web interface. (Details not shown.)