 |
|
|
|
This application note explains configuration of HP Virus Throttle (connection rate filtering) on ProCurve switches. This details the operation of the new version of Virus Throttle. Until the K.12.01 release, Virus Throttle on a ProCurve switch was able to detect virus-like network behavior—identified as a high number of connections to a high number of different IP addresses in a short time—and to prevent the traffic from the originating source from being routed. Thus, in a network with multiple VLANs, an infected machine could only contact other systems in its own VLAN. This was Virus Throttle at layer 3.
Beginning with the K.12.01 release, the switch is now able to block traffic from an infected machine even within a VLAN: if a virus is detected, within a few seconds, the infected system cannot reach any other IP address. This new capability is more efficient and effective, and increases network protection against viruses.
General steps for configuration of Virus Throttle have not changed:
- You first specify the “sensitivity” of the filter you want to apply; you have a choice of low, medium, high, or aggressive throttling.
- Then you define the ports to which you apply this filter and the action you want the switch to take if a virus is detected. You can choose from:
- Notify-only: A trap is sent to ProCurve Manager Plus, but the traffic is not blocked
Block or throttle: Traffic is blocked for one minute, time for an administrator to find the machine and take action.
» Return to top
|
|
|
|
|
|
Two commands, connection-rate-filter and filter connection-rate, allow configuring Virus Throttle from the command line interface.
For example, here is how to activate virus throttling on ports 1-20, with sensitivity set to high. The following commands will cause traffic to be throttled when triggered by a virus:
To view virus throttling, use the show connection-rate-filter all command. For example:
 The output shows that no host is blocked or throttled yet.
When Virus Throttle is triggered by a client, the show connection-rate-filter all command displays the source IP address of the throttled virus. For example:
» Return to top
|
|
|
|
|
|
Another way to configure and manage Virus Throttle is with ProCurve Manager Plus.
5.1 Configure Virus Throttle
To configure Virus Throttle in PCM+ 2.2:
- In PCM+ 2.2, select the switch. In the right pane, in the Dashboard tab (first tab on the left), click on the Virus Throttle icon:
The VT Configuration window opens:
- In the VT Configuration window set the VT Status to enable VT and the VT Sensitivity to high.
- Specify the VT Action:
- To specify virus throttling on all ports of all switches, configure the VT Action for VT Management Devices to throttle.
- To specify throttling on only one switch, configure the VT Action to throttle for the IP address of the switch.
- To specify throttling on a port, click the + sign to expand the port list of each switch, and set the VT action to throttle individually on the port.
The example shows virus throttling specified on all ports of the 5400 switch: VT Action is set to no for VT
Management Devices, and to throttle for the switch at 10.1.1.2.
- Click Apply to enforce this policy on the switch. You see the Status: CT Configuration window, where you can confirm that virus throttling was successfully configured.
» Return to top
5.2 Troubleshooting
If the policy enforcement fails, it might be because the Communications Parameters known by PCM+ do not match the actual communication parameters on the device. To check the communication parameters:
- In PCM+ highlight the device, and on the Dashboard tab click the second icon from the right. You see a dropdown list of tests:
- Select Test Communication Parameters in PCM+. You see the Testing Communications Parameters window as testing proceeds:
- Confirm that Success appears against all parameters. If this is not the case, correct any mismatched parameters.
- Then in PCM+ go to the Port List tab, select Port Status, and verify that the Virus Filter Action has been set to throttle for all ports on the 5400:
» Return to top
5.3 Monitor and block viruses
Once Virus Throttle is configured, you can monitor virus activity and take action when needed:
- To see if the policy is triggered, select the Events tab. Virus throttling will appear as an event. In the example below you can see that you received a trap from the switch, indicating that Address 10.1.1.100 of type 1 has been flagged by the connection rate filter:
- To block viruses, return to the VT Configuration window, change the VT Action to block on all ports, and click Apply to apply the new configuration.
- In the Virus Throttle configuration window, click to the Blocked Hosts tab and confirm that the address of the blocked machine appears.
» Return to top
|
|
|
