Quarantine

What Is Quarantine?

Quarantine is the penalty box that the three protections use in common. When a protection wants to take the source that makes the request onto a list for a while instead of blocking a request only for that moment, Quarantine is selected as the action. A source that is taken into quarantine meets the same enforcement on every request until its period expires: the box membership takes precedence over the decisions of the protections, the source does not need to catch a rule again.

A single penalty box is kept per vService. Whichever protection has filled it, the source is located in the same table and the Reason column of the record tells who has put it into the box. The settings on this page determine with which key the source will be monitored, for how long it will stay inside and what will be done to its requests while it is inside.

Single

Penalty Box Per vService

The three protections and the challenge fill the same box; the record carries who has put it in the Reason column

3

Quarantine Actions

Silent Drop, Redirect and Show Content; the penalty can be a silent drop as well as a page that explains it

5

Tracking Keys

Four ready keys from IP to V-Host + IP + User-agent, and a manual definition with smart variables

30 Minutes

Default Duration

The quarantine duration is defined freely in the unit of minutes, hours or days

Persistent

No Repeated Match Required

Once the source has been taken inside, every request of it throughout the period is met by the penalty box before the decision of the protections

4

Filling the Box

The L7 DDoS, IP Reputation and Bot protections, together with the visitors that continuously cannot pass the challenge

Automatic

Source IP Ceiling

When the hard ceiling defined in the source IP limits is exceeded while the protection is in the Active mode, the quarantine is applied by itself

Live

Penalty Box Table

The sources inside are monitored instantly together with their entry and exit times, and are released manually when necessary

In Every Type

HTTP and L7 TCP

The penalty box works on both vService types; on L7 TCP the key and action set narrows

There are three enforcements to be applied to a source that stays inside:

Action	What the source sees
Silent Drop	The request is left unanswered; the connection is silently dropped. It is the default action.
Redirect	The request is redirected to a defined address.
Show Content	A page produced from the selected content profile and the defined status code are returned to the source.

Scope

The penalty box is present on the vServices of both the HTTP and the L7 TCP type. On L7 TCP only the IP and Manual tracking keys and only the Silent Drop action can be used: the ready keys based on the Host and User-Agent headers and the redirection and page display options are not listed on this type. The settings are kept even while no protection directs to the quarantine: the card can be edited independently of the protection configuration and works with the values that have been written when a protection starts to direct to it.

The box is filled only by the protections in the Active mode

The quarantine is applied when at least one of the protections that direct to it is in the Active mode. Quarantine being written in the rule list of a protection that is in the Monitoring mode is not enough for the source to be taken inside: the monitor mode only observes, the penalty box is not filled and the live table is not created.

The four reasons that fill the box

The record is always opened with one of four reasons: L7 DDoS Protection, IP Reputation Protection, Bot Protection and Captcha. There are five setting points that trigger this: the Quarantine action selected in the rule lists of L7 DDoS Protection, IP Reputation Protection and Bot Protection; the Quarantine Failed Captcha Solvers switch on the Captcha card; and the hard ceiling defined in the source IP limits of L7 DDoS. The action of the hard ceiling cannot be selected, it is directly the quarantine, and it opens the record with the L7 DDoS Protection reason.

The Quarantine Card on Bot/DDoS Management

The Quarantine card in the body of the Bot/DDoS Protection Mode strip summarizes the whole of the penalty in a single sentence: the tracking key, the duration and the action to be applied are written in order (e.g. IP, for 30m: Silent drop). The duration is emphasized in the sentence; if the action is Silent Drop it is shown in red, and in the actions that offer a page or a redirection to the visitor it is shown in the warning color. If a part of the settings has not been written yet, the sentence cannot be built and the card lists the fields line by line instead.

The Used by row below the card lists which protections direct to the penalty box with their short names: L7 DDoS, IP Reputation, Bot and, while the challenge trigger is on, Captcha. The row reads the configuration: a protection in the Monitoring mode also appears here, but only the ones in the Active mode fill the box. If none of them directs to the quarantine, the card fades and a sentence indicating that the settings are waiting ready is written in place of the row. The Table → link at the bottom right opens the live table of the penalty box as a closable tab on the same screen.

When the pencil icon at the top right of the card is clicked, the edit screen opens.

Bot/DDoS Protection Mode - The Quarantine Card

The Quarantine Edit Screen

1. The Bot/DDoS Management tab is opened.
2. The pencil icon at the top right of the Quarantine card in the body of the strip is clicked; the edit window titled Edit - Quarantine opens.
3. The following fields are edited and confirmed with the Edit button.

The Quarantine Edit Screen

INFO

Tracking Type Default: IP

With which key the source that is taken into quarantine will be monitored is selected; its default value is IP. The key determines not only who is inside but also how narrowly or how broadly the penalty will be applied: when only IP is selected, all the traffic that comes from the same address is penalized, and when a header is added to the address, the penalty narrows only to that client.

Option	The value monitored
IP	Only the source address. It can be used on the HTTP and L7 TCP vServices.
IP + User-agent	The source address and the User-Agent header together.
V-Host + IP	The Host header and the source address together.
V-Host + IP + User-agent	The Host header, the source address and the User-Agent header together.
Manual	The key is defined manually from the field below.

On the L7 TCP vServices the header-based options are not listed; only IP and Manual can be used.

Quarantine Tracking Keys

With this field, which appears in the form when Manual is selected as the tracking key, the values that identify the source are written with Variables (e.g. %SRCIP, %REQHEADER(host)). At least one value must be defined and the same value cannot be located in the list twice. When more than one value is written, the key consists of the combination of the values.

INFO

Quarantine Duration Default: 30 minutes

The period during which the source will stay in the penalty box is defined. The value is entered with a number and unit pair; minutes, hours or days can be selected as the unit. At least 1 can be entered in the number field; there is no upper limit, and its default value is 30 minutes. When the period expires, the record drops from the table by itself and the source enters the normal flow again. The requests made while it is inside do not extend the period; if the source is stamped again with a new violation, the period starts to run from the beginning.

INFO

Quarantine Action Default: Silent Drop

What will be done to the requests of the source while it is inside is selected; its default value is Silent Drop.

Option	Behavior
Silent Drop	The request is left unanswered, the connection is silently dropped.
Redirect	The request is redirected to the address defined in the field below.
Show Content	A response is returned with the content profile and the status code selected in the fields below.

On the L7 TCP vServices only Silent Drop is listed: the redirection and the page display are responses specific to HTTP.

Redirect Location Default: /robots.txt

With this field, which appears in the form while the action is Redirect, the address to which the source will be redirected is defined; its default value is /robots.txt. The field accepts Variables. The redirection code cannot be selected: the quarantine redirection is always made with 302. If the field is left empty, the redirection goes to the / address.

Content Page

With this field, which appears in the form while the action is Show Content, the content profile to be returned as the response is selected. By default, the built-in quarantine page profile (Quarantine page (English)) comes selected; a new profile can be created in place.

Status Code Default: 403

With this field, which appears in the form while the action is Show Content, the HTTP status code to be returned together with the response is selected; its default value is 403.

INFO

Edit

The changes in the form are saved by clicking the Edit button. There is no additional confirmation window or deployment (deploy) step; the Load Balancer configuration is automatically regenerated and applied.

The Quarantine Table

The Table → link below the card opens the live table of the penalty box as a closable tab named Quarantine on the upper strip of the screen. The table is not a saved history but the current content of the box: it shows the sources that are still in quarantine, when they have entered and when they will leave.

This table is created only while a path that directs to the quarantine is actually working; one of three conditions is enough and all three look for the Active mode: the quarantine action being present in the rule list of a protection, a hard ceiling being defined in the source IP limits of the L7 DDoS that is in the Active mode, or the challenge action being present in the rule list of a protection in the Active mode while the failure trigger of the challenge is on. If the conditions are not met, the tab still opens but there is no source to be listed. The name of the single source that feeds the tab is Quarantine Penalty Box; this name is read in the header of the preview panel of the selected record. There is no separate source per protection.

The Quarantine Table

The table opens with the following columns by default:

Column	Description
Quarantine Start	The time at which the source has been taken into the penalty box.
Quarantine Expiry	The time at which the record will drop from the box.
Source (Client) IP Address (key)	The address of the source monitored. The column heading follows the selected Tracking Type key; with the default key it appears with the ↓IP heading.
Reason	Who has put the source into the box: L7 DDoS Protection, IP Reputation Protection, Bot Protection or Captcha. If a source has been penalized from more than one path throughout the life of the record, all of the marks are written combined with +.

The following column is hidden by default and is added from the column selector:

Column	Description
Source	The name of the TR7 device that holds the record (in cluster setups). It is always present in the preview panel.

INFO

Since a single penalty box is kept, there is no separate tab per protection in the table; the distinction is read from the Reason column. The failed attempt counter of the sources that cannot pass the challenge is kept not in this table but in the tracking table of the Captcha card. Being taken into quarantine does not delete the counter record: a source that has reached the threshold appears in both tables until the tracking window expires.

The items in the toolbar are arranged from left to right in the following order; the last two items (Page Information and Page Size) are located in the information strip below the table.

Columns

Which columns are shown in the table is selected. In the same panel, columns are reordered by dragging and alignment is selected per column; the row height is fitted to the page with the Fit rows to the page button, and the column layout is reset to default with the Reset button. The layout is stored per user.

Filter

The Filter button is used to filter the list. The filtering criterion is the selected tracking key (e.g. ↓IP in this configuration); the criterion strip comes expanded when the table is opened and the number of active filters is written next to the criterion.

Export

The table is exported as Excel, CSV or PDF by clicking the Export button. In the window that opens, the Filename, Format and Data Source, together with the Columns to be exported, are determined; the remaining fields are displayed according to the format: CSV Separator for CSV, Excel Sheet Name for Excel, and Page Orientation and Page Size for PDF.

Refresh

The current content of the penalty box is brought again by clicking the Refresh button. Since there is a single source on the tab, no source picker is shown in addition.

Remove from Table

When one or more rows are selected and the Remove from Table button is clicked, the related sources are taken out of quarantine and released before their periods expire. The operation is verified with the Are you sure? confirmation and cannot be undone. The button is passive while no row is selected. The same operation is also present in the right-click menu.

Search

Used to search all information in the table.

RegExp Search

Used to search all information in the table with a regular expression (RegExp).

Column Based Search

Used to perform a column-based search on the information in the table.

Page Information

Contains information about the total number of fetched records and the range of records displayed in the list: Showing N-M of T records and the number of selected rows (N selected, or Nothing selected when there is no selection).

Page Size

The maximum number of records to be displayed on the page is selected. The default is 100; the options are 50, 100, 250 and All. The selection is not stored, and at the next opening it starts with 100 again.

Right-Click Menu

When a row is right-clicked, a menu with a single operation opens. The operation applies only to the right-clicked record; a selection made in the list does not affect the menu.

Operation	What it does
Remove from Table	Takes the right-clicked source out of the penalty box; like Remove from Table in the toolbar, it asks for Are you sure? confirmation. It is not displayed in the menu while the operation is going on.

Preview of the Selected Record

When any row in the list is clicked, the preview panel belonging to that record opens on the right side of the screen. The title of the panel is Quarantine Penalty Box; below it the name of the protected vService is located.

The Preview of the Selected Record

Operations are performed on the record with the icon at the top right of the header:

Operation	What it does
Remove from Table	Takes the source out of the penalty box; it is released before the period expires and the source enters the normal flow again. While the operation is going on, the icon turns into a spinning symbol. Unlike the toolbar and right-click paths, it deletes without asking for confirmation.

The panel shows the device that holds the record, the quarantine entry and exit times and the source monitored one below the other.

Information	Description
Source	The name of the TR7 device that holds the record (in cluster setups).
Quarantine Start	The time at which the source has been taken into the penalty box.
Quarantine Expiry	The time at which the record will drop from the box.
Source (Client) IP Address	The address of the source monitored.

Scope and Limits

INFO

• It is present on both vService types. On L7 TCP the key set is limited to IP and Manual, and the action set to Silent Drop.
• A single penalty box is kept per vService. The four entry paths fill the same table; the distinction is read from the Reason column.
• The settings are kept independently of the protections. The card can be edited even while no protection directs to the quarantine; the record is not lost, only the card appears faded.
• The box is filled only in the Active mode. The quarantine action being present in the rule list of a protection in the monitor mode is not enough for the source to be taken inside.
• The action of the source IP hard ceiling cannot be selected. The enforcement applied when the ceiling is exceeded is always the quarantine; for this reason, on a vService that has a ceiling defined, the penalty box is used even if the quarantine action has never been selected in the rule lists.
• When the period expires, the record drops by itself. The requests made while it is inside do not extend the period; a new violation, on the other hand, stamps the record again and starts the period from the beginning. Early removal is done only with Remove from Table or with the trash bin icon in the preview panel.
• The penalty box holds at most 5,000 records. The more narrowly the tracking key is selected (e.g. V-Host + IP + User-agent instead of IP), the more separate records enter the box.
• The challenge counter is not in this table. The failed attempt counter is kept in the tracking table of the Captcha card and being taken into quarantine does not delete that record; a source that has reached the threshold appears in both tables until the tracking window expires.
• The pencil icon depends on the permission. The card and the table are displayed with read-only permission; the pencil icon that opens the edit window is displayed only on the users that have edit permission.