Route Tables & L4 DDoS

Route Tables & L4 DDoS is the place where a route table is monitored and managed from a single screen. The screen brings together the traffic and threat dashboard of the table, the whole configuration of the L4 DDoS protection and the live view of the protection in the form of tabs.

Since the protection is defined per route table, this screen is also per route table: the rule modes, the limits, the exemption list, the quarantine duration and the telemetry of a table concern only itself. Two route tables on the same device can have stances independent of each other.

Only the feeds are common. The rule catalog is fixed and is displayed with the same rules in every route table; the IP reputation blacklist is kept device-wide and every route table applies this list with its own mode; the country and network databases are also device-wide and feed the exemption list of every table. The only exception to this is the TR7 Management Access band: since it protects the device's own management ports, it is displayed only in the DEFAULT route table of the main device.

There is no protection to be switched on in this module

The WAF and Bot/DDoS protections are enabled separately per vService; the L4 DDoS protection, on the other hand, is ready in every route table. The rule catalog is born together with the table and, since the catalog defaults are written while the route table is being created and in the configuration check at device startup, in a table that has never been touched a part of the rules runs in enforcement and a part in monitoring.

For this reason there is no "switch the protection on" step in this module. The work to be done is to adjust the stance that comes ready according to one's own traffic; what is to be done from where is explained on the L4 DDoS Management page.

There is no device-wide view in this module

In the WAF and Bot/DDoS modules there are screens that gather all the protected objects in a single list and global logs that combine all the events. In L4 DDoS there is no counterpart of these: the protection is monitored and managed in the context of a single route table, more than one table is not gathered on the same screen.

Route tables are not created and deleted here; adding and deleting a table is carried out from the Route Tables screen and the DEFAULT table cannot be deleted from any screen. The fields of an existing table, on the other hand, can also be edited in the Edit tab opened from the preview panel on this screen.

Accessing the Screen

Left Monitor Panel is opened.
Route Tables & L4 DDoS is selected from the category tabs at the top left.
The route tables defined on TR7 are listed.
The route table to be monitored is clicked; the screen opens with the Dashboard tab that carries the name of the route table.

In the category list, two counters are displayed under every row: the number of interfaces and IP addresses bound to the route table. A name and status filter can be applied to the list. Since the panel tabs can be arranged per user, if the category has been removed before, it is added again from the same selector.

All the route tables of the device to which the category is bound are in the list; since the protection is present in every table, no separate filtering is done. The DEFAULT table is also a member of the list.

Tabs

Tab	Visibility Condition	Content
the name of the route table	Always	The traffic and threat dashboard of the table (Dashboard).
L4 DDoS Management	Always	The whole L4 DDoS configuration of the route table.
L4 DDoS Live View	Always	The live view of the sources in quarantine and of the instant rule pressure.
Quarantine History	Always	The history of the sources that entered quarantine, listed according to the date range.

None of the four tabs can be closed. The label of the first tab is the name of the route table and the colored mark on its left shows the status of the table on the device. In a cluster setup this mark gives only the status of the device that is being worked on; the status of the two devices is displayed side by side in the header of the preview panel.

Next to these fixed tabs, a closable tab can also be formed: the editing operation started from the preview panel adds an Edit tab to the strip. When it is closed while it is active, the screen returns to the Dashboard tab.

There are two direct transitions between the tabs

The table link of the Quarantine box on the L4 DDoS Management screen does not open a separate tab, it passes directly to the L4 DDoS Live View tab.

In the same way, the threat strip in the live view shows a shortcut that leads to the learning recommendations when the general pressure reaches fifty percent and moves the screen to the L4 DDoS Management tab.

The authorization comes from the Network area

Displaying the screen requires monitoring authorization in the Network area. All the operations that change the configuration, the rule editing windows and the route table editing form, on the other hand, require change authorization in the same area; while this authorization is absent, the pencil icons in the rule rows are not displayed. The Edit button in the preview panel, on the other hand, continues to be displayed but does not start an operation.

The live view stays outside this distinction: the screen opens and the threat strip is displayed, but the filling of the table and the cards also depends on the change authorization.

While the network configuration is locked during synchronization, the editing of the L4 DDoS rules is disabled independently of the authorization. The route table's own editing form is not affected by this lock.

Division of Labor Between Tabs

What happened? Dashboard

The traffic carried by the route table and the telemetry produced by the protection are read side by side in the same time range: how much the line was loaded, how much of this load was an attack, how much was dropped. The preview panel that carries the summary of the selected route table is also open only in this tab.

What is happening now? L4 DDoS Live View

Which rule is under pressure, how many sources are in quarantine at that moment and how the open connections are distributed are monitored from here. This is also the only surface on which operations are performed on live objects: a source is released from quarantine, taken into the exemption list or the quarantine list of a rule is emptied completely.

Who was quarantined? Quarantine History

Every source that enters quarantine is kept here as a persistent record, also after its duration expires: which address, from which country, because of which rule and for how long it was quarantined is listed for the selected date range and narrowed with the filter strip.

What is set? L4 DDoS Management

All the rules, modes and limits of the protection bands together with the blacklist, quarantine and exemption boxes are gathered in this tab. The number of bands is four or five, since TR7 Management Access is displayed only in the DEFAULT table of the main device. Every rule is read in its own row with a full sentence; the editing is in that row's own pencil in most of the rules, and in the boxes that consist of a single setting the pencil is in the box itself.

What has been learned? Learning

The learning strip is located right below the protection mode strip in L4 DDoS Management: what the engine has learned from the traffic, how it evaluates the settings in force and which recommendations it keeps ready to be applied are monitored from here.