Protection Policies

Protection Policies is the group that collects the policy profiles that apply layered protection to the AGS-enabled vServices: the protection of the sessions that are opened, the account lockout against the failed login attempts, the detection of and the response to the bot traffic, together with the CAPTCHA verification providers that these policies use. In the AGS tab in the Configuration Menu, this group contains four screens; the left menu lists the screens in the order in the interface.

The policies are selected in the AGS settings of the vService: Session protection policy (a single policy), Default lockout policies and Bot protection policies (a multiple selection). The lockout policies can additionally be customized with Lockout behavior in the provider and MFA profiles. Every screen comes with built-in profiles; the built-in profiles do not appear in the lists, they are selected directly in the selectors in the vService and policy forms.

4

Screens

In the order in the Protection Policies group in the interface

16

Built-in profiles

4 session · 4 lockout · 6 bot · 2 CAPTCHA

3 steps

Lockout

Warning → CAPTCHA → lock; the user name, the IP or a custom scope

6

Bot actions

Deny · Tarpit · Block · Bandwidth Limit · Captcha · Show content

How do the screens work together?

1. In the CAPTCHA Providers screen a verification provider is defined (or the built-in Standard TR7 CAPTCHA is used).
2. In the Account Lockout Policies screen the scope of the failed attempts and the warning / CAPTCHA / lock thresholds are determined; the CAPTCHA step is bound to a provider.
3. In the Bot Protection Policies screen the trigger (the number of requests, an authentication failure, the bot score or static) and the action (denial, blocking, a rate limit, CAPTCHA, content) are defined.
4. In the Session Protection Policies screen the client properties to which the session will be bound, the concurrent session limit and the timeouts are determined.
5. The policies are selected in the AGS settings of the vService; the lockouts, the sessions and the bot tables are monitored from the Lockout, Sessions and live statistics tabs on the AGS management screen of the vService.

Screens

Session Protection Policies

Binding the session to the IP address, to the IP + User-Agent or to a custom component combination; the concurrent session limit and the operation to be applied when it is exceeded; the whitelist conditions; the idle and the absolute timeout. The built-in Standard, Strict, Relaxed and Single Device profiles.

→

Account Lockout Policies

The counting of the failed attempts in the scope of the user name, the IP, the user name + IP or a custom scope; the warning, CAPTCHA and lock thresholds, the lock period and the tracking window. The vService defaults and the lockout behavior on a provider/MFA basis.

→

Bot Protection Policies

The static, request count, authentication failure and bot score triggers; the Deny, Tarpit, Block, Bandwidth Limit, Captcha and Show content actions; the built-in rate limiting and bot score profiles.

→

CAPTCHA Providers

The offline TR7 Captcha (text/math) together with the Google reCAPTCHA, hCaptcha and Cloudflare Turnstile integrations; the route table and the re-asking period; the use in the lockout and bot policies.

→

Usage Locations

Screen	Where it is used
Session Protection Policies	The vService AGS settings Session protection policy; the vService Sessions tab
Account Lockout Policies	The vService AGS settings Default lockout policies; the Authentication Providers and MFA Lockout behavior / Lockout policies; the vService Lockout tab
Bot Protection Policies	The vService AGS settings Bot protection policies; the Bot: <policy name> tables in the vService live statistics
CAPTCHA Providers	The Captcha provider fields of Account Lockout Policies and Bot Protection Policies; the provider counters in the vService live statistics