Virtual Partitioning
Appliance logically partitions the traffic based on the subnet masks and you can have up to 8 independent policies for up to 512 subnets depending on the model and license. This ensures that there is no collateral damage when a partition is attacked. Each Partition on its own can be set to prevention or detection mode in either direction.
Country Code/IP Address Filters
(Geo Location Protection)
IntruGuard IG200/2000 feature a unique filtering capability through their hardware logic. This logic enables a network administrator to block a list of entire countries in a few clicks. Just click on a country using the GUI or CLI to either accept or block them in your appliance for both inbound as well as outbound traffic. You can select countries from a list. This Geo-Location feature allows organization to block or to apply additional in-depth application filtering on all traffic from countries that a network does not do business with, or that are known originators of malicious hacking (including US State Department identified terror sponsors). This feature dramatically saves bandwidth and lowers the risks of attacks.
Bogon Filtering, Access Control Lists
IntruGuard's appliances blocks traffic to restricted ports and limits traffic to allowed protocols. IntruGuard can provision an extensive list of known infected hosts which are blocked at appliance’s initial logic.
Packet Flood Mitigation / Protocol Verification
FPGA based hardware then filter packets by verifying Layers 3, 4 and 7 protocols are correctly formed.
Stateful Packet Inspection, Out-of-State Filtering
This layer verifies state by confirming the completion of the three way handshake. SYN Floods or other such attempts to utilize system resources are blocked at
this layer.
Granular Layer 3, 4 Filtering
IntruGuard appliances monitor traffic granularly at layer 3, 4 and 7. They can monitor up to 1 M source IPs, 1 M Connections, 1 M destination, all IP protocols, all TCP, UDP ports, ICMP type/codes. Any behavioral threshold that is violated, is immediately within 2 seconds stopped.
Application Layer Filtering, Get and Resource Flood Filtering
Many attackers have deployed methods to overwhelm system resources by establishing valid connections. IntruGuard appliances work at the application layer to prevent this type of attack. Patented Source Tracking helps isolate botnets that are using the same scripted attack using information such as User-Agent, Referer, URL, Host and Cookie accesses.
Algorithmic Filtering
IntruGuard’s patented system monitors traffic for unusual behavior. Anomalies are “red flagged” by the system. These include access to a URL without accessing images, CSS files. Using abnormal HTTP headers etc.
Heuristic Filtering
At application layer, IntruGuard's hardware logic monitors and prevents accesses that are heuristically known to be botnet oriented. This logic is continuously updated based on current trends.
|
