Wanguard 6.2 User Guide
Configuration » Network & Policy » IP Zone
Configuration » Network & Policy »
IP Zone
IP Zones
are hierarchical, tree-like data structures from which Sensor(s) extract per-subnet settings and learn
the monitored network's boundaries.
You must add all your IP blocks to the IP Zone(s) listed in Configuration » Network & Policy. You can add
prefixes (IP blocks/subnets/ranges) using the Console web interface, or from the CLI by executing the command “php
/opt/andrisoft/api/cli_api.php” on the Console server.
To define a new IP Zone, go to Configuration » Network & Policy » <+> » IP Zone. You need more than one IP
Zone only when you need different per-subnet settings for different Sensors. If this is the case, it may be easier to
open an existing IP Zone that already contains your IP address ranges, and duplicate it by pressing the <
Duplicate
>
button. A new IP Zone will be created with the same name and the word “(copy)” attached, containing the same
prefixes and IP groups as the original.
The IP Zone Configuration window is divided into two vertical sections. The buttons that manage prefixes are
located in the upper part of the left-hand section. When a new prefix is added, the tree below automatically updates
itself. The right-hand section contains panels with user-provided settings for the selected prefix.
To enter IP addresses or IP blocks, you must use the CIDR notation. To enter individual hosts in IP Zones, you
must use the /32 CIDR mask for IPv4, or /128 for IPv6. For more information about the CIDR notation, see Appendix 1
from page 104.
Every IP Zone contains at least the 0.0.0.0/0 network. Since the CIDR mask is /0, this “supernet” includes all
IP addresses available for IPv4 and IPv6. For an easier configuration, every new prefix that you define inherits by
default the properties of the closest (having the biggest CIDR) IP class that includes it.
The
IP Settings
panel in the right-hand section provides the following options:
●
IP Group
– This editable combo box should contain a short description of the selected prefix, or the
name of the customer that uses it. Setting the same IP group for multiple prefixes allows you to
generate aggregated traffic reports.
●
IP Graphing
– Set to “Yes” for the Sensor to generate graph data for every IP contained in the selected
prefix. The
Graph IP Sweeps
option from Configuration » General Settings » Graphs & Storage can be
used to prevent generating graph data for IPs that only receive traffic without sending any traffic in
return. IP Graphing is always enabled for the subnets explicitly defined in the IP Zone. Do not enable on
many/large subnets without a performance impact assessment.
●
IP Accounting
– Set to “Yes” for the Sensor to generate daily accounting data for each IP contained in
the selected prefix. IP Accounting is always enabled for the subnets explicitly defined in the IP Zone. Do
not enable on many/large subnets without a performance impact assessment.
The
Storage Requirements
column indicates the disk space needed to store the data generated by a single
Packet Sensor or Flow Sensor interface. Enabling IP graphing and IP accounting for very large prefixes (e.g. 0.0.0.0/0)
might generate (useless) data that can potentially overload the Console server.
The
Comments
panel allows you to write a comment for the selected prefix. It is not visible elsewhere.
- 34 -
Summary of Contents for wanguard 6.2
Page 1: ......
