TR7 Management Access

What Is TR7 Management Access?

TR7 Management Access limits the concurrent connections opened to the management ports of the device itself and is displayed only in the DEFAULT route table. The band is on the L4 DDoS Management screen and its explanation note gives its scope in a single line: Access limits for the appliance's own management ports.

All the other bands protect the traffic the device carries: the requests going to the backends, the connections coming to the published services. This band, on the other hand, protects the management surface of the device itself. The connections opened to the management interface and to the command line are a surface independent of the carried traffic and require their own limits.

All three rules of the band use the same measure: how many connections a source address can hold at the same time. This is the method difference of the band from the other bands; not the rate but the concurrency is measured.

Box	What it looks at
Management Ports	The number of concurrent SSH, HTTP and HTTPS management connections per source.

3

Rules

SSH · HTTP · HTTPS; all three measure concurrency

5 · 100 · 100

Default Ceilings

The number of concurrent connections per source

3

Able to Send to Quarantine

All three can take the source into quarantine

DEFAULT

The Table the Band Is Seen In

The band is displayed only in the DEFAULT route table of the device

IPv4 Only

The Scope of the Enforcement

The rules are not applied to the IPv6 management traffic

Enforcing 3

In an Untouched Table

All three rules are born in the Block mode

The band is seen only in the DEFAULT route table

The three rules of the band are meaningful only in the DEFAULT route table of the device; the management ports are published from there. When another route table is opened, this band is not displayed at all: neither its title nor its box is displayed.

The link is established not to the name of the table but to the table itself: this is the table that comes with TR7 and cannot be deleted. Even if the table is renamed the band stays in place, and giving the name DEFAULT to another table does not move the band there.

This is the feature that separates the band from all the other bands. The other bands are displayed with the same rules in every route table; this band is found only in one.

The same difference is valid on the dashboard as well: the panels of the band are located only on the dashboard of that route table.

The TR7 Management Access Band on L4 DDoS Management

The band is located at the very bottom of the screen. In the header there are the name of the band, the number of rules it carries in parentheses and below it the explanation note; at the top right there are the mode distribution badges.

L4 DDoS Management - The TR7 Management Access Band

Element	Meaning
The title and the number	The name of the band and the number of rules in it: TR7 Management Access (3).
The explanation note	The fixed text that summarizes the scope of the band.
The distribution badges	The mode distribution of the three rules: Enforcing, Monitoring and Off. A badge whose number is zero is not displayed.
The single box	In the header of the box there are its name and the number of rules it carries; the number of the band and of the box is the same in this band.

The band has no setting of its own

The band and the box carry no editing element. Every rule is adjusted with the pencil in its own row, in its own edit window.

Rule Modes

All three rules use the same value set: Disabled · Monitor · Block · Quarantine.

The color of the row is the color of the mode

At the beginning of every rule row there is a status dot and its color shows the mode of the rule:

Mode	Dot
Block and Quarantine	Green
Monitor	Amber
Disabled	Dim gray

The action word inside the sentence is colored separately: amber in the monitoring mode, red in the enforcement mode.

The catalog defaults are in force from day one

The catalog default of all three rules is Block and this value is written to the table while the route table is being created and in the configuration check at device startup. For this reason the band reads Enforcing 3 on a device that has never been touched as well: the management access is limited from day one.

The default ceilings are 5 concurrent SSH, 100 HTTP and 100 HTTPS connections per source.

In the monitoring mode no firewall rule is written

The rules of the band produce no rule at all in the monitoring mode. On the other hand their graphs on the dashboard continue to fill: the measurement is read not from the rule itself but from the connection table of the device.

This separates the band from the rules that measure a rate. There a targetless rule is written in the monitoring mode and the counter comes from that rule; here no rule is written at all.

Badges on the Row

At the right end of the rule row, where the sentence ends, there are small indicators. Their order from left to right is fixed: padlock → pencil → verdict badge.

Indicator	What it is	When it is seen
Padlock	A lock icon without a word, on its own. It is the operator's Learning Lock switch.	While the learning lock of the rule is on.
Pencil	It opens the edit window of the rule.	While there is change authorization.
Verdict badge	A clickable badge carrying an icon and a word. It is the verdict of the learning engine in the last round.	If the engine has run at least one round.

The verdict badge shows one of four words: Suggestion (there is a recommendation waiting to be applied), Locked (the engine has a change but it cannot be applied), Learning (there is no word to say yet) and Verified (the current setting was found in place).

While the exemption list is empty these three rules cannot be promoted

In the rules of the band the Locked badge has a source of its own: while there is no manually added entry in the exemption list and there are no trusted peer servers either, the engine refuses to promote these rules into enforcement. The local network entry the system adds itself does not meet this condition.

The justification is the risk of locking oneself out: if the management access is taken into an enforcement that exempts no source, the administrator who exceeds the ceiling can lose their own connection. For this reason the engine waits until the exemption list is ready.

A filled exemption list is not enough on its own. All three rules are in the class that measures a threshold; for the engine to promote them from monitoring into enforcement, the Mode Promotion permission must also be on, the learned ceiling must have settled, the back-test must come out clean and the confidence threshold must be exceeded.

The engine can also recommend a ceiling for these rules. The recommended ceiling does not go below 5 in the SSH rule and below 50 in the HTTP and HTTPS rules.

This protection binds only the learning engine. Nothing prevents Block or Quarantine from being selected manually from the edit window of the rule.

Edit Window

The pencil that comes right after the sentence in every row opens the rule's own edit window. The title of the window is in the form Rule settings · <rule name>.

Element	When it is found
The information band	In every rule. It shows the catalog definition of the rule.
Status	In every rule. The same four values are offered in all three.
Learning Lock	In every rule.
Concurrent Limit	In every rule. It carries no unit; what is measured is not a rate but the number of concurrent connections.
Save	In every rule. It is inactive while there is a validation error.

The saving updates only the changed fields and takes effect immediately. If no field has changed, the request is not sent.

Rules in the Box

Management Ports

The ceilings of the number of concurrent SSH, HTTP and HTTPS management connections per source.

→

Scope and Limits

INFO

• The band is displayed only in the DEFAULT route table of the device; it is never seen in the other route tables and the link is established not to the name of the table but to the table itself.
• All three rules measure concurrency, not a rate.
• The rules are applied only to the traffic directed at the device; the traffic passed through the device is outside the scope.
• The enforcement works only on the IPv4 traffic; the measurement, on the other hand, counts both IP versions together.
• In the monitoring mode no firewall rule is written; the measurement is read from the connection table.
• The established management sessions are not affected; the ceiling is applied only to the new connections.
• On a device that has never been touched all three rules are born in the Block mode.
• While the exemption list is empty the learning engine cannot promote these rules; the promotion also depends on the Mode Promotion permission, a settled ceiling, a clean back-test and sufficient confidence. Nothing prevents changing them manually.
• The ceiling recommended by the learning engine does not go below 5 in the SSH rule and below 50 in the HTTP and HTTPS rules.
• The sources in the exemption list are not caught by the ceiling and are not written to the measurement either.
• Editing requires modify permission in the Network area.