Arxceo ALLY IP1000, User Manual

23

Ally IP1000 Factory Default Configuration 

Configuration 

Parameter 

Possible 

Settings 

Default Intrusion 

Implication Mgmt. 

Console 

Page 

AllyRTCfg 

Option 

DNS Tunneling 

Detection 

!

Enabled 

!

Disabled 

Enabled 

There are applications that allow 

network conversations to be 
clandestinely established using 

DNS traffic. The Ally detects this 
DNS Tunneling by counting the 

number of DNS messages sent 
from a particular source IP address 
during a specified time period. 

Systems that exceed this threshold 
are added to the dynamic blacklist 

associated with the adapter on 
which these messages were 

received. No further traffic from a 
dynamically blacklisted system is 

passed through the Ally IP1000  
until the "Blacklist Time Period" 
has elapsed. 

UDP 

Policy 

-dt 

Blacklist Due to 
DNS Tunneling 
after DNS 

Packets/ 
Seconds 

Any unsigned 

32-bit 

integers 

10/5 

The DNS Tunneling threshold 
consists of a maximum number of 
DNS packets received in a 

specified number of seconds. 

UDP 
Policy 

-tc 
-tt 

ICMP Policy 

!

Discard All 

!

Analyze 

!

Allow All 

Analyze 

Selecting “Analyze” activates the 

ICMP policy parameters, i.e. the 
next 12 entries in this table. 

General 

Filtering 
Options 

-ai 

ICMP Echo 

Request Policy   

!

Discard All 

!

Allow All 

Allow All 

ICMP 

Policy 

-ec 

ICMP Echo 
Reply Policy   

!

Discard All 

!

Allow All 

Allow All 

ICMP 
Policy 

-er 
 

ICMP Source 
Quench Policy   

!

Discard All 

!

Allow All 

Allow All 

ICMP 
Policy 

-sq 

ICMP Redirect 

Policy   

!

Discard All 

!

Allow All 

Allow All 

ICMP 

Policy 

-re 

ICMP Time 
Exceeded Policy   

!

Discard All 

!

Allow All 

Allow All 

ICMP 
Policy 

-te 

ICMP Parameter 

Problem Policy   

!

Discard All 

!

Allow All 

Allow All 

ICMP 

Policy 

-pp 

ICMP 
Timestamp 

Request Policy   

!

Discard All 

!

Allow All 

Allow All 

ICMP 
Policy 

-ts 

ICMP 
Timestamp 

Reply Policy   

!

Discard All 

!

Allow All 

Allow All 

ICMP 
Policy 

-tr 

ICMP 
Information 

Request Policy   

!

Discard All 

!

Allow All 

Allow All 

ICMP 
Policy 

-ir 

ICMP 
Information 

Reply Policy   

!

Discard All 

!

Allow All 

Allow All 

Select the types of ICMP packets 

that will be allowed to pass 
through the Ally IP1000. By 

default, all ICMP packet types are 
allowed except “Destination 

Unreachable” and "Port 
Unreachable". These packets are 

discarded to prevent UDP port 
scanning and certain Denial of 
Service (DoS) attacks. 

ICMP 
Policy 

-ip