Quarantine can be used to prevent an infected machine

Quarantine can be used to prevent an infected machine from spreading worms, or leaking confidential
information due to spyware infection. It can also be used to inform the user that something has gone
wrong.
• Traffic matches against a Filter with configured for Block + IPS Quarantine
• Spyware Filters are a great example
• IPS immediately blocks the malicious flow (due to the block)
• IPS optionally intercepts web requests redirects to external server or displays Quarantine
block page
• IPS optionally blocks other traffic

TippingPoint Administrator Training
Rev 10.5.17
129
Quarantine Concept (Thresholds)
Quarantine actions can also occur at a user-defined threshold. You can configure permit and trust
actions to take effect before the threshold is triggered.
For example, you can display a Quarantine web page to notify a quarantined user of the problem and
provide instructions for fixing it, or the action may redirect all traffic from the quarantined IP address to
a quarantine serve that provides instructions to correct the problem.
• Define thresholds, where quarantine occurs after “excessive” filter hits
– Ideal for failed login attempts
– You configure the threshold that you want traffic to be permitted until the threshold is
reached
– Threshold is defined by hit count within a certain period

TippingPoint Administrator Training
130
Rev. 10.5.17
Quarantine Considerations
– Block immediately or Threshold
• If threshold, how many hits over what time period
– Web Requests: What do you want displayed?
• Nothing, i.e. just block web requests
• Redirect web requests to an external server
• Have the IPS display the Quarantine Block page
– Other Traffic: Block other non-web traffic?
– Restrictions / Exceptions
• Hosts that you do or do not want to be Quarantined
– Quarantine Access
• Addresses which can be reached by hosts in Quarantine
– How do hosts get released from Quarantine?
• Manual or Automatically (timeout)
– Which filters should trigger IPS Quarantine?

TippingPoint Administrator Training
Rev 10.5.17
131
Quarantine Action Set
Quarantine Settings
The IPS examines filter hits by attackers IP address. Hit counts are qualified and accumulated within a
sliding time window (Period). Quarantine is automatically initiated when the accumulated hit count
exceeds the threshold. All qualified hits for a given attacking IP address are accumulated with a single
counter. If an attacker uses a variety of attacks they all contribute to the same accumulated Hit Count as
long as they have the same action set specified.
Web requests from the quarantined host can be blocked, redirected to a specific web server, or have a
template web page displayed. The web page can be customized to include the name and description of
the filter causing the quarantine, the description and/or display customized HTML specified by the user.