summaryrefslogtreecommitdiff
path: root/data/templates/ids/fastnetmon.tmpl
diff options
context:
space:
mode:
authorDmitriyEshenko <dmitriy.eshenko@vyos.io>2020-07-03 09:08:41 +0000
committerDmitriyEshenko <dmitriy.eshenko@vyos.io>2020-07-03 12:02:20 +0000
commit669d24a5e0abfbecf1557fefe1ebcd69a8ff7f0e (patch)
tree72fdbfeeb226d89949c510932688bdb96139836a /data/templates/ids/fastnetmon.tmpl
parent1b7b50000f4b2ef15a45dd84ea213a74b3b54d88 (diff)
downloadvyos-1x-669d24a5e0abfbecf1557fefe1ebcd69a8ff7f0e.tar.gz
vyos-1x-669d24a5e0abfbecf1557fefe1ebcd69a8ff7f0e.zip
ids: T2659: Implement fastnetmon support
Diffstat (limited to 'data/templates/ids/fastnetmon.tmpl')
-rw-r--r--data/templates/ids/fastnetmon.tmpl60
1 files changed, 60 insertions, 0 deletions
diff --git a/data/templates/ids/fastnetmon.tmpl b/data/templates/ids/fastnetmon.tmpl
new file mode 100644
index 000000000..71a1b2bd7
--- /dev/null
+++ b/data/templates/ids/fastnetmon.tmpl
@@ -0,0 +1,60 @@
+# enable this option if you want to send logs to local syslog facility
+logging:local_syslog_logging = on
+
+# list of all your networks in CIDR format
+networks_list_path = /etc/networks_list
+
+# list networks in CIDR format which will be not monitored for attacks
+white_list_path = /etc/networks_whitelist
+
+# Enable/Disable any actions in case of attack
+enable_ban = on
+
+## How many packets will be collected from attack traffic
+ban_details_records_count = 500
+
+## How long (in seconds) we should keep an IP in blocked state
+## If you set 0 here it completely disables unban capability
+ban_time = 1900
+
+# Check if the attack is still active, before triggering an unban callback with this option
+# If the attack is still active, check each run of the unban watchdog
+unban_only_if_attack_finished = on
+
+# enable per subnet speed meters
+# For each subnet, list track speed in bps and pps for both directions
+enable_subnet_counters = off
+
+{% if "mirror" in mode %}
+mirror_afpacket = on
+{% endif -%}
+
+{% if "in" in direction %}
+process_incoming_traffic = on
+{% endif -%}
+{% if "out" in direction %}
+process_outgoing_traffic = on
+{% endif -%}
+{% for th in threshold %}
+{% if th == "fps" %}
+ban_for_flows = on
+threshold_flows = {{ threshold[th] }}
+{% endif -%}
+{% if th == "mbps" %}
+ban_for_bandwidth = on
+threshold_mbps = {{ threshold[th] }}
+{% endif -%}
+{% if th == "pps" %}
+ban_for_pps = on
+threshold_pps = {{ threshold[th] }}
+{% endif -%}
+{% endfor -%}
+
+{% if listen_interface %}
+{% set value = listen_interface if listen_interface is string else listen_interface | join(',') %}
+interfaces = {{ value }}
+{% endif -%}
+
+{% if alert_script %}
+notify_script_path = {{ alert_script }}
+{% endif -%}