lb threat-protection

The lb threat-protection command manages the traffic protection settings of a vService: the threshold-based DDoS protections, the country and network type rules, the address reputation, the bot protection, the quarantine and the waiting room. Its panel equivalent is the Threat Protection tab of the vService.

There is no adding or deleting in this command

The protection record is born by itself when the vService is created. There are no add and delete sub-commands; the record is changed only with update, and with update-many the same setting is written to many vServices together.

Command Summary

TR7 WEB-CLI · lb threat-protection

# Tab after the command

admin@TR7LBWAF01> lb threat-protection

list show update update-many

 

admin@TR7LBWAF01> lb threat-protection list # list all of them

admin@TR7LBWAF01> lb threat-protection show <id> # show one

admin@TR7LBWAF01> lb threat-protection update id <id> …

admin@TR7LBWAF01> lb threat-protection update-many target <target> …

admin@TR7LBWAF01>  

The Common Structure of the Protection Families

All the threshold-based protections consist of the same five parts. Configuring a family means writing these parts in order.

Step 1 Turn on the protection

--<family>Protection true

Step 2 Determine the measurement window

--<family>Window.val 10 --<family>Window.unit s

Step 3 Put the threshold

--<family>Limit 1000 — if needed, a hard limit with --<family>HardLimit

Step 4 Select the action

--<family>Action <action>

Step 5 Give the detail of the action

The status code in blocking, the address in a redirect, the page in showing content.

The same action fields are repeated in every family: BlockStatusCode determines the code that will be returned in blocking, RedirectLoc and RedirectCode the redirect, and ContentProfile and ContentStatusCode the page that will be shown.

The Required Field

Field	Status	What it does	What is written after it
id	Required	Determines the protection record of which vService will be changed	The id of the protection record; Tab lists them

The DDoS Protection Family

The whole family is turned on with a single switch; the exemptions are valid for all the sub-protections.

Field	What it does	What is written after it
--ddosProtection	Turns on the whole DDoS protection family	true · false
--ddosTrustVerifiedBots	Exempts the verified search engine bots from the DDoS protection	true · false
--ddosWhitelistCond	Determines in which condition the DDoS exemption will be applied	A condition expression
--ddosWhitelistEntries.N.type	Selects the type of the exemption entry	Address · network · ASN · country
--ddosWhitelistEntries.N.ip	Determines the address that will be exempted	An IP address
--ddosWhitelistEntries.N.cidr	Determines the mask length of the network that will be exempted	A CIDR value
--ddosWhitelistEntries.N.asn	Determines the autonomous system that will be exempted	An ASN value
--ddosWhitelistEntries.N.country	Determines the country that will be exempted	A country value

Threshold Protection: the number of requests per source address

This protection watches the number of requests per source address measure. The names of the fields are written with the ddosSrcIpRequest prefix.

Field	What it does	What is written after it
--ddosSrcIpRequestProtection	Turns on this protection family	true · false
--ddosSrcIpRequestWindow.val	Determines in which time window the measurement will be done	The duration value and unit — the number part
--ddosSrcIpRequestWindow.unit	Determines in which time window the measurement will be done	The duration value and unit — the unit part
--ddosSrcIpRequestLimit	Determines the threshold that must not be exceeded within the window	A number
--ddosSrcIpRequestAction	Selects what will be done when the threshold is exceeded	Actions such as block · redirect · show content · CAPTCHA · quarantine
--ddosSrcIpRequestHardLimit	Determines the hard threshold that is blocked directly when it is exceeded	A number
--ddosSrcIpRequestBlockStatusCode	Determines the status code that will be returned in the block action	An HTTP status code
--ddosSrcIpRequestRedirectLoc	Determines the address that will be gone to in the redirect action	An address
--ddosSrcIpRequestRedirectCode	Determines the status code that will be used in the redirect action	An HTTP status code
--ddosSrcIpRequestContentProfile	Selects the page that will be used in the show content action	The lb page record
--ddosSrcIpRequestContentStatusCode	Determines the status code that will be returned in the show content action	An HTTP status code

Threshold Protection: the number of connections per source address

This protection watches the number of connections per source address measure. The names of the fields are written with the ddosSrcIpConnection prefix.

Field	What it does	What is written after it
--ddosSrcIpConnectionProtection	Turns on this protection family	true · false
--ddosSrcIpConnectionWindow.val	Determines in which time window the measurement will be done	The duration value and unit — the number part
--ddosSrcIpConnectionWindow.unit	Determines in which time window the measurement will be done	The duration value and unit — the unit part
--ddosSrcIpConnectionLimit	Determines the threshold that must not be exceeded within the window	A number
--ddosSrcIpConnectionAction	Selects what will be done when the threshold is exceeded	Actions such as block · redirect · show content · CAPTCHA · quarantine
--ddosSrcIpConnectionHardLimit	Determines the hard threshold that is blocked directly when it is exceeded	A number
--ddosSrcIpConnectionBlockStatusCode	Determines the status code that will be returned in the block action	An HTTP status code
--ddosSrcIpConnectionRedirectLoc	Determines the address that will be gone to in the redirect action	An address
--ddosSrcIpConnectionRedirectCode	Determines the status code that will be used in the redirect action	An HTTP status code
--ddosSrcIpConnectionContentProfile	Selects the page that will be used in the show content action	The lb page record
--ddosSrcIpConnectionContentStatusCode	Determines the status code that will be returned in the show content action	An HTTP status code

Threshold Protection: the total number of requests of the service

This protection watches the total number of requests of the service measure. The names of the fields are written with the ddosTotalRequest prefix.

Field	What it does	What is written after it
--ddosTotalRequestProtection	Turns on this protection family	true · false
--ddosTotalRequestWindow.val	Determines in which time window the measurement will be done	The duration value and unit — the number part
--ddosTotalRequestWindow.unit	Determines in which time window the measurement will be done	The duration value and unit — the unit part
--ddosTotalRequestLimit	Determines the threshold that must not be exceeded within the window	A number
--ddosTotalRequestAction	Selects what will be done when the threshold is exceeded	Actions such as block · redirect · show content · CAPTCHA · quarantine
--ddosTotalRequestHardLimit	Determines the hard threshold that is blocked directly when it is exceeded	A number
--ddosTotalRequestBlockStatusCode	Determines the status code that will be returned in the block action	An HTTP status code
--ddosTotalRequestRedirectLoc	Determines the address that will be gone to in the redirect action	An address
--ddosTotalRequestRedirectCode	Determines the status code that will be used in the redirect action	An HTTP status code
--ddosTotalRequestContentProfile	Selects the page that will be used in the show content action	The lb page record
--ddosTotalRequestContentStatusCode	Determines the status code that will be returned in the show content action	An HTTP status code

Threshold Protection: the total number of connections of the service

This protection watches the total number of connections of the service measure. The names of the fields are written with the ddosTotalConnection prefix.

Field	What it does	What is written after it
--ddosTotalConnectionProtection	Turns on this protection family	true · false
--ddosTotalConnectionWindow.val	Determines in which time window the measurement will be done	The duration value and unit — the number part
--ddosTotalConnectionWindow.unit	Determines in which time window the measurement will be done	The duration value and unit — the unit part
--ddosTotalConnectionLimit	Determines the threshold that must not be exceeded within the window	A number
--ddosTotalConnectionAction	Selects what will be done when the threshold is exceeded	Actions such as block · redirect · show content · CAPTCHA · quarantine
--ddosTotalConnectionHardLimit	Determines the hard threshold that is blocked directly when it is exceeded	A number
--ddosTotalConnectionBlockStatusCode	Determines the status code that will be returned in the block action	An HTTP status code
--ddosTotalConnectionRedirectLoc	Determines the address that will be gone to in the redirect action	An address
--ddosTotalConnectionRedirectCode	Determines the status code that will be used in the redirect action	An HTTP status code
--ddosTotalConnectionContentProfile	Selects the page that will be used in the show content action	The lb page record
--ddosTotalConnectionContentStatusCode	Determines the status code that will be returned in the show content action	An HTTP status code

Threshold Protection: the number of error responses

This protection watches the number of error responses measure. The names of the fields are written with the ddosError prefix.

Field	What it does	What is written after it
--ddosErrorProtection	Turns on this protection family	true · false
--ddosErrorWindow.val	Determines in which time window the measurement will be done	The duration value and unit — the number part
--ddosErrorWindow.unit	Determines in which time window the measurement will be done	The duration value and unit — the unit part
--ddosErrorLimit	Determines the threshold that must not be exceeded within the window	A number
--ddosErrorAction	Selects what will be done when the threshold is exceeded	Actions such as block · redirect · show content · CAPTCHA · quarantine
--ddosErrorBlockStatusCode	Determines the status code that will be returned in the block action	An HTTP status code
--ddosErrorRedirectLoc	Determines the address that will be gone to in the redirect action	An address
--ddosErrorRedirectCode	Determines the status code that will be used in the redirect action	An HTTP status code
--ddosErrorContentProfile	Selects the page that will be used in the show content action	The lb page record
--ddosErrorContentStatusCode	Determines the status code that will be returned in the show content action	An HTTP status code

Threshold Protection: the number of active source addresses

This protection watches the number of active source addresses measure. The names of the fields are written with the ddosActiveSources prefix.

Field	What it does	What is written after it
--ddosActiveSourcesProtection	Turns on this protection family	true · false
--ddosActiveSourcesLimit	Determines the threshold that must not be exceeded within the window	A number
--ddosActiveSourcesAction	Selects what will be done when the threshold is exceeded	Actions such as block · redirect · show content · CAPTCHA · quarantine
--ddosActiveSourcesBlockStatusCode	Determines the status code that will be returned in the block action	An HTTP status code
--ddosActiveSourcesRedirectLoc	Determines the address that will be gone to in the redirect action	An address
--ddosActiveSourcesRedirectCode	Determines the status code that will be used in the redirect action	An HTTP status code
--ddosActiveSourcesContentProfile	Selects the page that will be used in the show content action	The lb page record
--ddosActiveSourcesContentStatusCode	Determines the status code that will be returned in the show content action	An HTTP status code

Rule-Based Protection: the country

The country-based rules are written with their own indexes and each one carries a separate measure and threshold.

Field	What it does	What is written after it
--ddosCountryProtection	Turns on this protection family	true · false
--ddosCountryWindow.val	Determines in which time window the measurement will be done	The duration value and unit — the number part
--ddosCountryWindow.unit	Determines in which time window the measurement will be done	The duration value and unit — the unit part
--ddosCountryWhitelist.N	Determines the ones that will be exempted from this protection	The values selected from the list
--ddosCountryRules.N.match	Selects whether the rule will be applied to the traffic that enters the list or to the traffic that does not	The matching form
--ddosCountryRules.N.countries.N	Determines the countries that the rule will cover	Country values
--ddosCountryRules.N.metric	Selects which measure the rule will watch	A measure value
--ddosCountryRules.N.limit	Determines the threshold of the measure that must not be exceeded	A number
--ddosCountryRules.N.action	Selects what will be done when the threshold is exceeded	An action value
--ddosCountryRules.N.blockStatusCode	Determines the status code that will be returned in blocking	An HTTP status code
--ddosCountryRules.N.redirectLoc	Determines the address that will be gone to in a redirect	An address
--ddosCountryRules.N.redirectCode	Determines the status code that will be used in a redirect	An HTTP status code
--ddosCountryRules.N.contentProfile	Selects the page that will be used while showing content	A content page record
--ddosCountryRules.N.contentStatusCode	Determines the status code that will be returned while showing content	An HTTP status code
--ddosCountryRules.N.bwLimitMbit	Determines the bandwidth limit	An Mbit value
--ddosCountryRules.N.allowLearning	Allows this rule to be applied in the learning mode	true · false

Rule-Based Protection: the network type

The network type based rules are written with their own indexes and each one carries a separate measure and threshold.

Field	What it does	What is written after it
--ddosNettypeProtection	Turns on this protection family	true · false
--ddosNettypeWindow.val	Determines in which time window the measurement will be done	The duration value and unit — the number part
--ddosNettypeWindow.unit	Determines in which time window the measurement will be done	The duration value and unit — the unit part
--ddosNettypeWhitelist.N	Determines the ones that will be exempted from this protection	The values selected from the list
--ddosNettypeRules.N.match	Selects whether the rule will be applied to the traffic that enters the list or to the traffic that does not	The matching form
--ddosNettypeRules.N.groups.N	Determines the network type groups that the rule will cover	Group values
--ddosNettypeRules.N.metric	Selects which measure the rule will watch	A measure value
--ddosNettypeRules.N.limit	Determines the threshold of the measure that must not be exceeded	A number
--ddosNettypeRules.N.action	Selects what will be done when the threshold is exceeded	An action value
--ddosNettypeRules.N.blockStatusCode	Determines the status code that will be returned in blocking	An HTTP status code
--ddosNettypeRules.N.redirectLoc	Determines the address that will be gone to in a redirect	An address
--ddosNettypeRules.N.redirectCode	Determines the status code that will be used in a redirect	An HTTP status code
--ddosNettypeRules.N.contentProfile	Selects the page that will be used while showing content	A content page record
--ddosNettypeRules.N.contentStatusCode	Determines the status code that will be returned while showing content	An HTTP status code
--ddosNettypeRules.N.bwLimitMbit	Determines the bandwidth limit	An Mbit value
--ddosNettypeRules.N.allowLearning	Allows this rule to be applied in the learning mode	true · false

The Address Reputation Protection

It applies an action according to the reputation category of the source address.

Field	What it does	What is written after it
--ipRepProtection	Turns on the address reputation protection	true · false
--ipRepWhitelistCond	Determines in which condition the reputation exemption will be applied	A condition expression
--ipRepWhitelistEntries.N.type	Selects the type of the exemption entry	Address · network · ASN
--ipRepWhitelistEntries.N.ip	Determines the address that will be exempted	An IP address
--ipRepWhitelistEntries.N.cidr	Determines the mask length of the network that will be exempted	A CIDR value
--ipRepWhitelistEntries.N.asn	Determines the autonomous system that will be exempted	An ASN value
--ipRepActions.N.categories.N	Selects to which reputation categories the rule will be applied	Category values
--ipRepActions.N.action	Selects what will be done in those categories	An action value
--ipRepActions.N.blockStatusCode	Determines the status code that will be returned in blocking	An HTTP status code
--ipRepActions.N.redirectLoc	Determines the address that will be gone to in a redirect	An address
--ipRepActions.N.redirectCode	Determines the status code that will be used in a redirect	An HTTP status code
--ipRepActions.N.contentProfile	Selects the page that will be used while showing content	A content page record
--ipRepActions.N.contentStatusCode	Determines the status code that will be returned while showing content	An HTTP status code
--ipRepActions.N.allowLearning	Allows this rule to be applied in the learning mode	true · false

The Bot Protection

It scores the probability of the client being a bot and applies an action according to the score.

Field	What it does	What is written after it
--botProtection	Turns on the bot protection	true · false
--botFactors.N	Selects from which criteria the bot score will be calculated	Criterion values
--botClientEvidence	Turns on the use of the evidence collected on the client side	true · false
--botTrustVerifiedBots	Exempts the verified search engine bots from the bot protection	true · false
--botWhitelistCond	Determines in which condition the bot exemption will be applied	A condition expression
--botWhitelistEntries.N.type	Selects the type of the exemption entry	Address · network · ASN · value
--botWhitelistEntries.N.ip	Determines the address that will be exempted	An IP address
--botWhitelistEntries.N.cidr	Determines the mask length of the network that will be exempted	A CIDR value
--botWhitelistEntries.N.asn	Determines the autonomous system that will be exempted	An ASN value
--botWhitelistEntries.N.value	Determines the value that will be exempted	A value
--botActions.N.threshold	Determines from which bot score on the rule will be applied	A score value
--botActions.N.action	Selects what will be done at that score	An action value
--botActions.N.blockStatusCode	Determines the status code that will be returned in blocking	An HTTP status code
--botActions.N.redirectLoc	Determines the address that will be gone to in a redirect	An address
--botActions.N.redirectCode	Determines the status code that will be used in a redirect	An HTTP status code
--botActions.N.contentProfile	Selects the page that will be used while showing content	A content page record
--botActions.N.contentStatusCode	Determines the status code that will be returned while showing content	An HTTP status code
--botActions.N.allowLearning	Allows this rule to be applied in the learning mode	true · false
--eventLogScoreFloor	Determines the lowest bot score that will be written to the event log	A score value

The CAPTCHA Settings

It determines the appearance of the page that will be shown when the CAPTCHA action is selected and the verification time.

Field	What it does	What is written after it
--captchaType	Selects the CAPTCHA type	A CAPTCHA type
--captchaSize	Selects the CAPTCHA size	A size value
--captchaBgColor	Determines the background color of the CAPTCHA page	A color value
--captchaTextColor	Determines the text color of the CAPTCHA page	A color value
--captchaDifficulty	Selects the CAPTCHA difficulty level	A difficulty value
--captchaLanguage	Selects the CAPTCHA language	A language value
--captchaTitle	Determines the tab title of the CAPTCHA page	The title text
--captchaTheme	Selects the theme of the CAPTCHA page	A theme value
--captchaVerifiedTtl.val	Determines how long the verification will stay valid	A number
--captchaVerifiedTtl.unit	Determines the unit of the verification time	A unit

The Quarantine

It makes the sources that exceed the threshold be taken into a separate behavior for a while.

Field	What it does	What is written after it
--quarantineCaptchaFail	Turns on the failed CAPTCHA attempts leading to the quarantine	true · false
--quarantineCaptchaFailThreshold	Determines after how many failed attempts it will be taken into the quarantine	A number
--quarantineCaptchaFailWindow.val	Determines the window in which the failed attempts are counted	A number
--quarantineCaptchaFailWindow.unit	Determines the unit of the window	A unit
--quarantineTrackingType	Selects according to what the quarantine will be tracked	A tracking type
--quarantineManualTrackingKeys.N	Determines the variables that will be used in the manual tracking	Smart variables
--quarantineTime.val	Determines how long the quarantine will last	A number
--quarantineTime.unit	Determines the unit of the quarantine time	A unit
--quarantineAction	Selects what will be done to the request in the quarantine	An action value
--quarantineRedirectLoc	Determines the redirect address in the quarantine	An address
--quarantineContentProfile	Selects the page that will be shown in the quarantine	A content page record
--quarantineStatusCode	Determines the status code that will be returned in the quarantine	An HTTP status code

The Waiting Room

It queues the visitors above the capacity and lets them in at the determined rate.

Field	What it does	What is written after it
--waitingRoom	Turns on the waiting room	true · false
--waitingRoomCapacity	Determines how many visitors will be let in at the same time	A number
--waitingRoomCond	Determines in which traffic the waiting room will be applied	A condition expression
--waitingRoomPageRules.N.cond	Determines which waiting page will be shown in which condition	A condition expression
--waitingRoomPageRules.N.pageProfile	Selects the page that will be shown in that condition	A content page record
--waitingRoomContentProfile	Selects the page that will be shown in the waiting room	A content page record
--waitingRoomEntryRate	Determines the rate of letting in from the waiting room	A number
--waitingRoomIdleTimeout.val	Determines after how long without an action the visitor will be dropped	A number
--waitingRoomIdleTimeout.unit	Determines the unit of this time	A unit
--waitingRoomRefreshSec	Determines every how many seconds the waiting page will be refreshed	Seconds
--waitingRoomTrustVerifiedBots	Makes the verified bots not be taken into the waiting room	true · false

The Learning Mode

It observes the traffic without applying the rules and produces threshold suggestions.

Field	What it does	What is written after it
--learningMode	Turns on the learning mode; it observes without the rules being applied	true · false
--learningLookback.val	Determines how far back the learning will look	A number
--learningLookback.unit	Determines the unit of the look-back time	A unit
--learningTrustedCountries.N	Determines the countries that will be trusted in the learning	Country values
--learningTrustedNettypeGroups.N	Determines the network type groups that will be trusted in the learning	Group values
--learningTuneOnly	Makes the learning produce only a threshold suggestion	true · false
--learningInterval	Determines at which interval the learning evaluation will be done	An interval value

Bildirimler

It determines how and to whom the protection events will be notified.

Field	What it does	What is written after it
--notifySuggestionsMute	Mutes the learning suggestion notifications	true · false
--notifyStateBand	Determines on which status changes a notification will be produced	A status band value
--advancedNotifications.N.scope	Selects in which scope the advanced notification will be counted	A scope value
--advancedNotifications.N.maskV4	Determines with which mask the IPv4 addresses will be grouped	The mask length
--advancedNotifications.N.maskV6	Determines with which mask the IPv6 addresses will be grouped	The mask length
--advancedNotifications.N.countType	Selects what will be counted	A counting type
--advancedNotifications.N.reportFileTypes.N	Selects the report formats that will be added to the notification	File format values
--advancedNotifications.N.window.val	Determines the window of the counting	A number
--advancedNotifications.N.window.unit	Determines the unit of the window	A unit
--advancedNotifications.N.limit	Determines the threshold at which a notification will be produced	A number
--notifyCountryMatch	Selects how the country filter will be applied	The matching form
--notifyCountryList.N	Determines the countries that will be used in the filter	Country values
--notifyNettypeMatch	Selects how the network type filter will be applied	The matching form
--notifyNettypeList.N	Determines the network type groups that will be used in the filter	Group values
--notifyEmail.N	Determines the email addresses to which the notification will be sent	An email address
--notifySms.N	Determines the phone numbers to which the notification will be sent	A phone number
--notifySnmp	Turns on the notification being sent as an SNMP trap	true · false
--notifyUi	Turns on the notification being shown in the interface	true · false

Examples

TR7 WEB-CLI · A) The request threshold per source address

admin@TR7LBWAF01> lb threat-protection update id <id> \

--ddosProtection true --ddosSrcIpRequestProtection true \

--ddosSrcIpRequestWindow.val 10 --ddosSrcIpRequestWindow.unit s \

--ddosSrcIpRequestLimit 200 --ddosSrcIpRequestAction <action> \

--ddosSrcIpRequestBlockStatusCode 429

admin@TR7LBWAF01>  

TR7 WEB-CLI · B) A country rule and an exemption

admin@TR7LBWAF01> lb threat-protection update id <id> \

--ddosCountryProtection true --ddosCountryRules.0.countries.0 <country> \

--ddosCountryRules.0.metric <measure> --ddosCountryRules.0.limit 500 --ddosCountryRules.0.action <action> \

--ddosWhitelistEntries.0.type <type> --ddosWhitelistEntries.0.ip 10.0.0.0 --ddosWhitelistEntries.0.cidr 8

admin@TR7LBWAF01>  

TR7 WEB-CLI · C) The bot protection and the learning mode

# observe first; the rules are not applied, a suggestion is produced

admin@TR7LBWAF01> lb threat-protection update id <id> \

--botProtection true --botActions.0.threshold 70 --botActions.0.action <action> \

--learningMode true --learningTuneOnly true

admin@TR7LBWAF01>  

Bulk Update

update-many applies the same change to many protection records at once. The writing order is the same on every resource.

Step 1 Select the target

The only required field is target: selected for the records selected from the list, all for the entire collection.

Step 2 Add the fields to be written

Only the fields that can be written to many records with the same value are present; the fields specific to the record, such as the id, the name and the vService id, do not take place in this command.

Step 3 Mark the targets from the list

When target selected is written and no id is given, a selection list with checkboxes opens.

Step 4 Confirm

A warning stating how many records will be affected appears; nothing is written until the confirmation word is typed.

Field	Status	Value
target	Required	selected — the records selected from the list · all — the whole collection
--ids.N	Conditional	The target ids for target selected. It is not suggested in the Tab list: the targets are marked from the selection list. In a script and in a pipeline it is written manually.
--onError	Optional	abort (default) — if even one of the targets does not pass the validation, nothing is written · skip — the targets that pass are written

Writable Fields

TR7 WEB-CLI · update-many · Tab output

# Tab after the command

admin@TR7LBWAF01> lb threat-protection update-many

--info target

 

# Tab after the target field

admin@TR7LBWAF01> lb threat-protection update-many target

all selected

 

# write -- and Tab: all the writable fields

admin@TR7LBWAF01> lb threat-protection update-many target all --

--ids.N                                      --onError                                    --ddosProtection

--ddosTrustVerifiedBots                      --ddosWhitelistCond                          --ddosWhitelistEntries.N.type

--ddosWhitelistEntries.N.ip                  --ddosWhitelistEntries.N.cidr                --ddosWhitelistEntries.N.asn

--ddosWhitelistEntries.N.country             --ddosCountryProtection                      --ddosCountryWindow

--ddosCountryWhitelist.N                     --ddosCountryRules.N.match                   --ddosCountryRules.N.countries.N

--ddosCountryRules.N.metric                  --ddosCountryRules.N.limit                   --ddosCountryRules.N.action

--ddosCountryRules.N.blockStatusCode         --ddosCountryRules.N.redirectLoc             --ddosCountryRules.N.redirectCode

--ddosCountryRules.N.allowLearning           --ddosCountryRules.N.contentProfile          --ddosCountryRules.N.contentStatusCode

--ddosCountryRules.N.bwLimitMbit             --ddosNettypeProtection                      --ddosNettypeWindow

--ddosNettypeWhitelist.N                     --ddosNettypeRules.N.match                   --ddosNettypeRules.N.groups.N

--ddosNettypeRules.N.metric                  --ddosNettypeRules.N.limit                   --ddosNettypeRules.N.action

--ddosNettypeRules.N.blockStatusCode         --ddosNettypeRules.N.redirectLoc             --ddosNettypeRules.N.redirectCode

--ddosNettypeRules.N.allowLearning           --ddosNettypeRules.N.contentProfile          --ddosNettypeRules.N.contentStatusCode

--ddosNettypeRules.N.bwLimitMbit             --ddosSrcIpRequestProtection                 --ddosSrcIpRequestWindow

--ddosSrcIpRequestLimit                      --ddosSrcIpRequestAction                     --ddosSrcIpRequestBlockStatusCode

--ddosSrcIpRequestRedirectLoc                --ddosSrcIpRequestRedirectCode               --ddosSrcIpRequestContentProfile

--ddosSrcIpRequestContentStatusCode          --ddosSrcIpRequestHardLimit                  --ddosSrcIpConnectionProtection

--ddosSrcIpConnectionWindow                  --ddosSrcIpConnectionLimit                   --ddosSrcIpConnectionAction

--ddosSrcIpConnectionBlockStatusCode         --ddosSrcIpConnectionRedirectLoc             --ddosSrcIpConnectionRedirectCode

--ddosSrcIpConnectionContentProfile          --ddosSrcIpConnectionContentStatusCode       --ddosSrcIpConnectionHardLimit

--ddosErrorProtection                        --ddosErrorWindow                            --ddosErrorLimit

--ddosErrorAction                            --ddosErrorBlockStatusCode                   --ddosErrorRedirectLoc

--ddosErrorRedirectCode                      --ddosErrorContentProfile                    --ddosErrorContentStatusCode

--ddosTotalRequestProtection                 --ddosTotalRequestWindow                     --ddosTotalRequestLimit

--ddosTotalRequestAction                     --ddosTotalRequestBlockStatusCode            --ddosTotalRequestRedirectLoc

--ddosTotalRequestRedirectCode               --ddosTotalRequestContentProfile             --ddosTotalRequestContentStatusCode

--ddosTotalRequestHardLimit                  --ddosTotalConnectionProtection              --ddosTotalConnectionWindow

--ddosTotalConnectionLimit                   --ddosTotalConnectionAction                  --ddosTotalConnectionBlockStatusCode

--ddosTotalConnectionRedirectLoc             --ddosTotalConnectionRedirectCode            --ddosTotalConnectionContentProfile

--ddosTotalConnectionContentStatusCode       --ddosTotalConnectionHardLimit               --ddosActiveSourcesProtection

--ddosActiveSourcesLimit                     --ddosActiveSourcesAction                    --ddosActiveSourcesBlockStatusCode

--ddosActiveSourcesRedirectLoc               --ddosActiveSourcesRedirectCode              --ddosActiveSourcesContentProfile

--ddosActiveSourcesContentStatusCode         --ipRepProtection                            --ipRepWhitelistCond

--ipRepWhitelistEntries.N.type               --ipRepWhitelistEntries.N.ip                 --ipRepWhitelistEntries.N.cidr

--ipRepWhitelistEntries.N.asn                --ipRepActions.N.categories.N                --ipRepActions.N.action

--ipRepActions.N.blockStatusCode             --ipRepActions.N.redirectLoc                 --ipRepActions.N.redirectCode

--ipRepActions.N.contentProfile              --ipRepActions.N.allowLearning               --ipRepActions.N.contentStatusCode

--botProtection                              --botFactors.N                               --botClientEvidence

--botTrustVerifiedBots                       --botWhitelistCond                           --botWhitelistEntries.N.type

--botWhitelistEntries.N.ip                   --botWhitelistEntries.N.cidr                 --botWhitelistEntries.N.asn

--botWhitelistEntries.N.value                --botActions.N.threshold                     --botActions.N.action

--botActions.N.blockStatusCode               --botActions.N.redirectLoc                   --botActions.N.redirectCode

--botActions.N.contentProfile                --botActions.N.allowLearning                 --botActions.N.contentStatusCode

--eventLogScoreFloor                         --captchaDifficulty                          --captchaLanguage

--captchaTitle                               --captchaTheme                               --captchaVerifiedTtl

--quarantineCaptchaFail                      --quarantineCaptchaFailThreshold             --quarantineCaptchaFailWindow

--quarantineTrackingType                     --quarantineManualTrackingKeys.N             --quarantineTime

--quarantineAction                           --quarantineRedirectLoc                      --quarantineContentProfile

--quarantineStatusCode                       --waitingRoom                                --waitingRoomCapacity

--waitingRoomCond                            --waitingRoomPageRules.N.cond                --waitingRoomPageRules.N.pageProfile

--waitingRoomContentProfile                  --waitingRoomEntryRate                       --waitingRoomIdleTimeout

--waitingRoomRefreshSec                      --waitingRoomTrustVerifiedBots               --learningMode

--learningLookback                           --learningTrustedCountries.N                 --learningTrustedNettypeGroups.N

--learningTuneOnly                           --learningInterval                           --notifyStateBand

--notifySuggestionsMute                      --advancedNotifications.N.scope              --advancedNotifications.N.maskV4

--advancedNotifications.N.maskV6             --advancedNotifications.N.countType          --advancedNotifications.N.reportFileTypes.N

--advancedNotifications.N.window             --advancedNotifications.N.limit              --notifyCountryMatch

--notifyCountryList.N                        --notifyNettypeMatch                         --notifyNettypeList.N

--notifyEmail.N                              --notifySms.N                                --notifySnmp

--notifyUi                                   --info

admin@TR7LBWAF01>  

There are 179 fields in the command; the list above is the same as what appears when -- is written and Tab is pressed on the device. What each one does and what is written after it is in the table below.

The fields that are condition-bound in the single command (those that open according to the value of another field) are listed here without a condition: in the bulk update every target is validated separately according to its own record, and if the field is not active on a target it is skipped only on that target.

Field	What it does	What is written after it
--ids.N	Determines the targets of the bulk update	The protection record ids
--onError	Determines what will happen if a target does not pass the validation	abort writes nothing (default) · skip writes the targets that pass
--ddosProtection	Turns on the whole DDoS protection family	true · false
--ddosTrustVerifiedBots	Exempts the verified search engine bots from the DDoS protection	true · false
--ddosWhitelistCond	Determines in which condition the DDoS exemption will be applied	A condition expression
--ddosWhitelistEntries.N.type	Selects the type of the exemption entry	Address · network · ASN · country
--ddosWhitelistEntries.N.ip	Determines the address that will be exempted	An IP address
--ddosWhitelistEntries.N.cidr	Determines the mask length of the network that will be exempted	A CIDR value
--ddosWhitelistEntries.N.asn	Determines the autonomous system that will be exempted	An ASN value
--ddosWhitelistEntries.N.country	Determines the country that will be exempted	A country value
--ddosCountryProtection	Turns on this protection family	true · false
--ddosCountryWindow	Determines in which time window the measurement will be done	The duration value and unit
--ddosCountryWhitelist.N	Determines the ones that will be exempted from this protection	The values selected from the list
--ddosCountryRules.N.match	Selects whether the rule will be applied to the traffic that enters the list or to the traffic that does not	The matching form
--ddosCountryRules.N.countries.N	Determines the countries that the rule will cover	Country values
--ddosCountryRules.N.metric	Selects which measure the rule will watch	A measure value
--ddosCountryRules.N.limit	Determines the threshold of the measure that must not be exceeded	A number
--ddosCountryRules.N.action	Selects what will be done when the threshold is exceeded	An action value
--ddosCountryRules.N.blockStatusCode	Determines the status code that will be returned in blocking	An HTTP status code
--ddosCountryRules.N.redirectLoc	Determines the address that will be gone to in a redirect	An address
--ddosCountryRules.N.redirectCode	Determines the status code that will be used in a redirect	An HTTP status code
--ddosCountryRules.N.allowLearning	Allows this rule to be applied in the learning mode	true · false
--ddosCountryRules.N.contentProfile	Selects the page that will be used while showing content	A content page record
--ddosCountryRules.N.contentStatusCode	Determines the status code that will be returned while showing content	An HTTP status code
--ddosCountryRules.N.bwLimitMbit	Determines the bandwidth limit	An Mbit value
--ddosNettypeProtection	Turns on this protection family	true · false
--ddosNettypeWindow	Determines in which time window the measurement will be done	The duration value and unit
--ddosNettypeWhitelist.N	Determines the ones that will be exempted from this protection	The values selected from the list
--ddosNettypeRules.N.match	Selects whether the rule will be applied to the traffic that enters the list or to the traffic that does not	The matching form
--ddosNettypeRules.N.groups.N	Determines the network type groups that the rule will cover	Group values
--ddosNettypeRules.N.metric	Selects which measure the rule will watch	A measure value
--ddosNettypeRules.N.limit	Determines the threshold of the measure that must not be exceeded	A number
--ddosNettypeRules.N.action	Selects what will be done when the threshold is exceeded	An action value
--ddosNettypeRules.N.blockStatusCode	Determines the status code that will be returned in blocking	An HTTP status code
--ddosNettypeRules.N.redirectLoc	Determines the address that will be gone to in a redirect	An address
--ddosNettypeRules.N.redirectCode	Determines the status code that will be used in a redirect	An HTTP status code
--ddosNettypeRules.N.allowLearning	Allows this rule to be applied in the learning mode	true · false
--ddosNettypeRules.N.contentProfile	Selects the page that will be used while showing content	A content page record
--ddosNettypeRules.N.contentStatusCode	Determines the status code that will be returned while showing content	An HTTP status code
--ddosNettypeRules.N.bwLimitMbit	Determines the bandwidth limit	An Mbit value
--ddosSrcIpRequestProtection	Turns on this protection family	true · false
--ddosSrcIpRequestWindow	Determines in which time window the measurement will be done	The duration value and unit
--ddosSrcIpRequestLimit	Determines the threshold that must not be exceeded within the window	A number
--ddosSrcIpRequestAction	Selects what will be done when the threshold is exceeded	Actions such as block · redirect · show content · CAPTCHA · quarantine
--ddosSrcIpRequestBlockStatusCode	Determines the status code that will be returned in the block action	An HTTP status code
--ddosSrcIpRequestRedirectLoc	Determines the address that will be gone to in the redirect action	An address
--ddosSrcIpRequestRedirectCode	Determines the status code that will be used in the redirect action	An HTTP status code
--ddosSrcIpRequestContentProfile	Selects the page that will be used in the show content action	The lb page record
--ddosSrcIpRequestContentStatusCode	Determines the status code that will be returned in the show content action	An HTTP status code
--ddosSrcIpRequestHardLimit	Determines the hard threshold that is blocked directly when it is exceeded	A number
--ddosSrcIpConnectionProtection	Turns on this protection family	true · false
--ddosSrcIpConnectionWindow	Determines in which time window the measurement will be done	The duration value and unit
--ddosSrcIpConnectionLimit	Determines the threshold that must not be exceeded within the window	A number
--ddosSrcIpConnectionAction	Selects what will be done when the threshold is exceeded	Actions such as block · redirect · show content · CAPTCHA · quarantine
--ddosSrcIpConnectionBlockStatusCode	Determines the status code that will be returned in the block action	An HTTP status code
--ddosSrcIpConnectionRedirectLoc	Determines the address that will be gone to in the redirect action	An address
--ddosSrcIpConnectionRedirectCode	Determines the status code that will be used in the redirect action	An HTTP status code
--ddosSrcIpConnectionContentProfile	Selects the page that will be used in the show content action	The lb page record
--ddosSrcIpConnectionContentStatusCode	Determines the status code that will be returned in the show content action	An HTTP status code
--ddosSrcIpConnectionHardLimit	Determines the hard threshold that is blocked directly when it is exceeded	A number
--ddosErrorProtection	Turns on this protection family	true · false
--ddosErrorWindow	Determines in which time window the measurement will be done	The duration value and unit
--ddosErrorLimit	Determines the threshold that must not be exceeded within the window	A number
--ddosErrorAction	Selects what will be done when the threshold is exceeded	Actions such as block · redirect · show content · CAPTCHA · quarantine
--ddosErrorBlockStatusCode	Determines the status code that will be returned in the block action	An HTTP status code
--ddosErrorRedirectLoc	Determines the address that will be gone to in the redirect action	An address
--ddosErrorRedirectCode	Determines the status code that will be used in the redirect action	An HTTP status code
--ddosErrorContentProfile	Selects the page that will be used in the show content action	The lb page record
--ddosErrorContentStatusCode	Determines the status code that will be returned in the show content action	An HTTP status code
--ddosTotalRequestProtection	Turns on this protection family	true · false
--ddosTotalRequestWindow	Determines in which time window the measurement will be done	The duration value and unit
--ddosTotalRequestLimit	Determines the threshold that must not be exceeded within the window	A number
--ddosTotalRequestAction	Selects what will be done when the threshold is exceeded	Actions such as block · redirect · show content · CAPTCHA · quarantine
--ddosTotalRequestBlockStatusCode	Determines the status code that will be returned in the block action	An HTTP status code
--ddosTotalRequestRedirectLoc	Determines the address that will be gone to in the redirect action	An address
--ddosTotalRequestRedirectCode	Determines the status code that will be used in the redirect action	An HTTP status code
--ddosTotalRequestContentProfile	Selects the page that will be used in the show content action	The lb page record
--ddosTotalRequestContentStatusCode	Determines the status code that will be returned in the show content action	An HTTP status code
--ddosTotalRequestHardLimit	Determines the hard threshold that is blocked directly when it is exceeded	A number
--ddosTotalConnectionProtection	Turns on this protection family	true · false
--ddosTotalConnectionWindow	Determines in which time window the measurement will be done	The duration value and unit
--ddosTotalConnectionLimit	Determines the threshold that must not be exceeded within the window	A number
--ddosTotalConnectionAction	Selects what will be done when the threshold is exceeded	Actions such as block · redirect · show content · CAPTCHA · quarantine
--ddosTotalConnectionBlockStatusCode	Determines the status code that will be returned in the block action	An HTTP status code
--ddosTotalConnectionRedirectLoc	Determines the address that will be gone to in the redirect action	An address
--ddosTotalConnectionRedirectCode	Determines the status code that will be used in the redirect action	An HTTP status code
--ddosTotalConnectionContentProfile	Selects the page that will be used in the show content action	The lb page record
--ddosTotalConnectionContentStatusCode	Determines the status code that will be returned in the show content action	An HTTP status code
--ddosTotalConnectionHardLimit	Determines the hard threshold that is blocked directly when it is exceeded	A number
--ddosActiveSourcesProtection	Turns on this protection family	true · false
--ddosActiveSourcesLimit	Determines the threshold that must not be exceeded within the window	A number
--ddosActiveSourcesAction	Selects what will be done when the threshold is exceeded	Actions such as block · redirect · show content · CAPTCHA · quarantine
--ddosActiveSourcesBlockStatusCode	Determines the status code that will be returned in the block action	An HTTP status code
--ddosActiveSourcesRedirectLoc	Determines the address that will be gone to in the redirect action	An address
--ddosActiveSourcesRedirectCode	Determines the status code that will be used in the redirect action	An HTTP status code
--ddosActiveSourcesContentProfile	Selects the page that will be used in the show content action	The lb page record
--ddosActiveSourcesContentStatusCode	Determines the status code that will be returned in the show content action	An HTTP status code
--ipRepProtection	Turns on the address reputation protection	true · false
--ipRepWhitelistCond	Determines in which condition the reputation exemption will be applied	A condition expression
--ipRepWhitelistEntries.N.type	Selects the type of the exemption entry	Address · network · ASN
--ipRepWhitelistEntries.N.ip	Determines the address that will be exempted	An IP address
--ipRepWhitelistEntries.N.cidr	Determines the mask length of the network that will be exempted	A CIDR value
--ipRepWhitelistEntries.N.asn	Determines the autonomous system that will be exempted	An ASN value
--ipRepActions.N.categories.N	Selects to which reputation categories the rule will be applied	Category values
--ipRepActions.N.action	Selects what will be done in those categories	An action value
--ipRepActions.N.blockStatusCode	Determines the status code that will be returned in blocking	An HTTP status code
--ipRepActions.N.redirectLoc	Determines the address that will be gone to in a redirect	An address
--ipRepActions.N.redirectCode	Determines the status code that will be used in a redirect	An HTTP status code
--ipRepActions.N.contentProfile	Selects the page that will be used while showing content	A content page record
--ipRepActions.N.allowLearning	Allows this rule to be applied in the learning mode	true · false
--ipRepActions.N.contentStatusCode	Determines the status code that will be returned while showing content	An HTTP status code
--botProtection	Turns on the bot protection	true · false
--botFactors.N	Selects from which criteria the bot score will be calculated	Criterion values
--botClientEvidence	Turns on the use of the evidence collected on the client side	true · false
--botTrustVerifiedBots	Exempts the verified search engine bots from the bot protection	true · false
--botWhitelistCond	Determines in which condition the bot exemption will be applied	A condition expression
--botWhitelistEntries.N.type	Selects the type of the exemption entry	Address · network · ASN · value
--botWhitelistEntries.N.ip	Determines the address that will be exempted	An IP address
--botWhitelistEntries.N.cidr	Determines the mask length of the network that will be exempted	A CIDR value
--botWhitelistEntries.N.asn	Determines the autonomous system that will be exempted	An ASN value
--botWhitelistEntries.N.value	Determines the value that will be exempted	A value
--botActions.N.threshold	Determines from which bot score on the rule will be applied	A score value
--botActions.N.action	Selects what will be done at that score	An action value
--botActions.N.blockStatusCode	Determines the status code that will be returned in blocking	An HTTP status code
--botActions.N.redirectLoc	Determines the address that will be gone to in a redirect	An address
--botActions.N.redirectCode	Determines the status code that will be used in a redirect	An HTTP status code
--botActions.N.contentProfile	Selects the page that will be used while showing content	A content page record
--botActions.N.allowLearning	Allows this rule to be applied in the learning mode	true · false
--botActions.N.contentStatusCode	Determines the status code that will be returned while showing content	An HTTP status code
--eventLogScoreFloor	Determines the lowest bot score that will be written to the event log	A score value
--captchaDifficulty	Selects the CAPTCHA difficulty level	A difficulty value
--captchaLanguage	Selects the CAPTCHA language	A language value
--captchaTitle	Determines the tab title of the CAPTCHA page	The title text
--captchaTheme	Selects the theme of the CAPTCHA page	A theme value
--captchaVerifiedTtl	Determines how long the verification will stay valid	A duration value (the number and the unit together)
--quarantineCaptchaFail	Turns on the failed CAPTCHA attempts leading to the quarantine	true · false
--quarantineCaptchaFailThreshold	Determines after how many failed attempts it will be taken into the quarantine	A number
--quarantineCaptchaFailWindow	Determines the window in which the failed attempts are counted	A duration value (the number and the unit together)
--quarantineTrackingType	Selects according to what the quarantine will be tracked	A tracking type
--quarantineManualTrackingKeys.N	Determines the variables that will be used in the manual tracking	Smart variables
--quarantineTime	Determines how long the quarantine will last	A duration value (the number and the unit together)
--quarantineAction	Selects what will be done to the request in the quarantine	An action value
--quarantineRedirectLoc	Determines the redirect address in the quarantine	An address
--quarantineContentProfile	Selects the page that will be shown in the quarantine	A content page record
--quarantineStatusCode	Determines the status code that will be returned in the quarantine	An HTTP status code
--waitingRoom	Turns on the waiting room	true · false
--waitingRoomCapacity	Determines how many visitors will be let in at the same time	A number
--waitingRoomCond	Determines in which traffic the waiting room will be applied	A condition expression
--waitingRoomPageRules.N.cond	Determines which waiting page will be shown in which condition	A condition expression
--waitingRoomPageRules.N.pageProfile	Selects the page that will be shown in that condition	A content page record
--waitingRoomContentProfile	Selects the page that will be shown in the waiting room	A content page record
--waitingRoomEntryRate	Determines the rate of letting in from the waiting room	A number
--waitingRoomIdleTimeout	Determines after how long without an action the visitor will be dropped	A duration value (the number and the unit together)
--waitingRoomRefreshSec	Determines every how many seconds the waiting page will be refreshed	Seconds
--waitingRoomTrustVerifiedBots	Makes the verified bots not be taken into the waiting room	true · false
--learningMode	Turns on the learning mode; it observes without the rules being applied	true · false
--learningLookback	Determines how far back the learning will look	A duration value (the number and the unit together)
--learningTrustedCountries.N	Determines the countries that will be trusted in the learning	Country values
--learningTrustedNettypeGroups.N	Determines the network type groups that will be trusted in the learning	Group values
--learningTuneOnly	Makes the learning produce only a threshold suggestion	true · false
--learningInterval	Determines at which interval the learning evaluation will be done	An interval value
--notifyStateBand	Determines on which status changes a notification will be produced	A status band value
--notifySuggestionsMute	Mutes the learning suggestion notifications	true · false
--advancedNotifications.N.scope	Selects in which scope the advanced notification will be counted	A scope value
--advancedNotifications.N.maskV4	Determines with which mask the IPv4 addresses will be grouped	The mask length
--advancedNotifications.N.maskV6	Determines with which mask the IPv6 addresses will be grouped	The mask length
--advancedNotifications.N.countType	Selects what will be counted	A counting type
--advancedNotifications.N.reportFileTypes.N	Selects the report formats that will be added to the notification	File format values
--advancedNotifications.N.window	Determines the window of the counting	A duration value (the number and the unit together)
--advancedNotifications.N.limit	Determines the threshold at which a notification will be produced	A number
--notifyCountryMatch	Selects how the country filter will be applied	The matching form
--notifyCountryList.N	Determines the countries that will be used in the filter	Country values
--notifyNettypeMatch	Selects how the network type filter will be applied	The matching form
--notifyNettypeList.N	Determines the network type groups that will be used in the filter	Group values
--notifyEmail.N	Determines the email addresses to which the notification will be sent	An email address
--notifySms.N	Determines the phone numbers to which the notification will be sent	A phone number
--notifySnmp	Turns on the notification being sent as an SNMP trap	true · false
--notifyUi	Turns on the notification being shown in the interface	true · false
--info	Writes what the command will do without running it	It does not take a value; it is written on its own

Fields that exist in the single command but not here, and the reasons:

Field	Why it is not here
id	The id that targets a single record; in the bulk command target and --ids.N take its place

Target Selection and Confirmation

TR7 WEB-CLI · selection list and confirmation

admin@TR7LBWAF01> lb threat-protection update-many target selected --ddosProtection true

 

?  Target objects

    space: mark · ctrl+a: all · enter: confirm

    Filter: (filter by typing) · esc: cancel

 

  [x] <record-1>

  [x] <record-2>

  [ ] <record-3>

    2 selected / 3

 

⚠  2 objects will be updated

    <record-1>, <record-2>

 

Type "yes" to confirm: yes

admin@TR7LBWAF01>  

TR7 WEB-CLI · the whole collection and writing in a script

# the whole collection: the list does not open, the confirmation comes directly

admin@TR7LBWAF01> lb threat-protection update-many target all --botProtection true

⚠  This operation will update ALL the objects in the collection

Type "yes" to confirm:

 

# in a script or in a pipeline: the targets are written by hand, the list does not open

admin@TR7LBWAF01> lb threat-protection update-many target selected \

--ids.0 <kimlik-1> --ids.1 <kimlik-2> --ddosProtection true --onError skip

admin@TR7LBWAF01>  

The screen language depends on the user

The texts in the selection list and on the confirmation screen come according to the language preference of the signed-in user. The confirmation word is yes in the English interface and evet in the Turkish interface.

The detailed behavior of bulk update — which fields can be written in bulk and the report returned for each target — is on the API Commands page.

Things to Know

• The record is born together with the vService. There is no add and delete in this command; the protection settings are changed by updating the existing record.
• The protection is turned on in two steps. First the main switch of the family (--ddosProtection), then the own switch of the related sub-protection has to be turned on.
• The exemptions belong to the family. The DDoS exemption list is valid for all the threshold protections; the address reputation and the bot protection have their own exemption lists.
• The learning mode does not apply the rules. While --learningMode true, the traffic is observed and threshold suggestions are produced; --learningTuneOnly true makes only a suggestion be produced. If a rule is wanted to run during the learning as well, the allowLearning field of that rule is turned on.
• If the action detail is not written, the default behavior is valid. When the block code, the redirect address or the content page is not given, the action runs with the default of the system.
• The protection has to be on in the vService as well. Unless the lb service record has --threatProtection true written in it, these settings do not come into play.