Which Traffic Is Inspected by the Intrusion Defense Module?
The current versions of Internet Firewall, NAT Firewall, and VPC Firewall all support the Intrusion Defense feature. For details, check whether the Intrusion Defense switch is enabled in Advanced Settings.
What Events Are Blocked When the Intrusion Defense Mode Is Set to Block?
In interception mode, the firewall blocks traffic based on the following characteristics.
Threat Intelligence: automatically blocks high-confidence network attacks/malicious access, and supports automatic blocking of outbound malicious access.
Basic Defense: supports automatic blocking for some high-confidence rules, while other rules still generate security event alarms.
Virtual Patching: supports automatic blocking of all traffic detected as vulnerability exploits.
How to Manually Block Risks in the Alarm List? Can I Add IP Addresses for Blocking?
For risks with a high number of alarms or high severity in the alarm list, users can manually block them. Users can also import IP addresses to be blocked into the Intrusion Defense blocklist. When these IP addresses attempt access, they will be directly blocked by CFW.
In Block Mode, When Is Traffic Blocked Automatically? Why Are Alarms Still Triggered After Block Mode Is Enabled?
In interception mode, CFW automatically blocks high-confidence risks and IP addresses in the blocklist.
Low-confidence risks will trigger alarms but will not be automatically blocked. Users can manually block the alarmed IP addresses in the Alarm Center.
How Is Blocking of Malicious IP Addresses Implemented in Strict Mode?
In strict mode, Threat Intelligence, Basic Defense, and Virtual Patching all operate in global interception mode and block all IP addresses that trigger alarms. High-confidence risks and IP addresses in the blocklist are blocked on their first access, while other malicious IP addresses are blocked directly on their second access after an alarm is triggered on their first access.
Why Was the Malicious IP Address Not Blocked?
The Intrusion Defense feature of CFW is session-based and blocks only session access with attack characteristics. If a user does not add the IP address to the blocklist, normal access sessions from that IP address will not be blocked.
When Should Block Mode Be Enabled?
Generally, after switching from observation mode to interception mode, if no business changes are observed for 1 to 2 days, you can keep interception mode enabled.
What If Policies Are Not Precise and Directly Enabling Blocking Affects Business?
In the Intrusion Defense module, the system sets only high-precision rules to interception mode. In particular, Virtual Patching has not had any false positives. If any issues occur after blocking is enabled, you can contact us at any time for assistance. After CFW Block Mode Is Enabled, Will It Affect Communication Between Private Network Addresses?
No. After interception mode is enabled, it only affects internet traffic of cloud services and does not affect communication between private network addresses in the cloud.
What Should I Do If an IP Address Is Blocked by Mistake by Intrusion Defense?
1. Log in to the CFW console and click Log Auditing > Intrusion Defense Logs to check whether the source or destination IP address has explicit blocking records. 2. In an emergency, you can go to the Intrusion Defense menu, disable "Enable Blocklist" to deactivate the blocklist, and then go to Alarm Center > Blocking Statistics to view all blocking statistics and identify the source of the blocks. 3. After locating and fixing the fault cause, you can turn on the "Enable Blocklist" switch to re-enable this feature.
How to Quickly Locate and Restore Access in Case of Incorrect Blocking or Inaccessibility?
If the Firewall Toggle for a public IP address is disabled, traffic does not pass through CFW.
Set IPS to observation mode and confirm that the issue is not caused by IPS blocking.
If the policy is configured as "any", the public IP address is fully open. Confirm that the issue is not caused by a CFW policy.
Note:
If false blocking or access failures persist after you complete the preceding operations, please submit a ticket. Why Did IP Addresses Previously in the Intrusion Defense Blocklist Disappear?
1. In the blocklist, when the validity period of an IP address expires, the IP address is automatically removed from the list. After that, subsequent traffic access from this IP address will not be blocked by the firewall.
2. To prevent the blocklist from automatically removing IP addresses that pose security risks, click Edit in the operation column on the right side of the list to modify the expiration time and date of the target IP address.
Will IP Addresses in the Intrusion Defense Ignore List Still Be Blocked?
IP addresses in the ignore list directly bypass the IDPS feature.
How Do I Configure Ignoring a Specific Detection Rule for an IP Address?
Ignoring a specific detection rule is not supported currently.
Under What Circumstances Does Traffic That Parses Domain Names Not Pass Through CFW?
Tencent Cloud CVM may use Tencent's self-built DNS resolution service, and the generated DNS packets do not pass through the internet boundary. As a result, alarms and logs for domain access in this part will be missing.
If you want a CVM to use the domain name detection and alarm features of CFW normally, you can manually change the resolution address in the /etc/resolv.conf file to 8.8.8.8.
What Is the Relationship Between Intrusion Defense and Access Control?
CFW evaluation order: Blocklist > Access Control rules > Allowlist > Intrusion Defense rules.
The Intrusion Defense feature takes effect only on assets with Firewall Toggle enabled. Traffic from assets without protection enabled does not pass through the firewall for processing.