Welcome to Wanguard 8.0 User Guide!

Contents

• 1. Copyright & Trademark Notices
• 2. Traffic Monitoring and DDoS Mitigation with Wanguard
  • 2.1. Key Features & Benefits
  • 2.2. Software Components
• 3. Choosing a Method of Traffic Monitoring and DDoS Detection
  • 3.1. Comparison between Packet Sniffing, Flow Monitoring, and SNMP Polling
• 4. Choosing a Method of DDoS Mitigation
  • 4.1. DDoS Mitigation with Wanguard Filter
  • 4.2. Technologies used by Wanguard Filter for DDoS mitigation
  • 4.3. Packet Filter Deployment Scenarios
• 5. System Requirements and Software Installation
  • 5.1. System Requirements
  • 5.2. Software Installation
  • 5.3. Opening the Console
  • 5.4. Licensing Procedure
  • 5.5. Quick Configuration Steps
• 6. Basic Concepts of Wanguard Console
  • 6.1. Side Region
  • 6.2. Central Region
  • 6.3. South Region
  • 6.4. Upper Menus
• 7. Configuration » General Settings » Graphs & Storage
  • 7.1. Sensor and Applications Graph Troubleshooting
  • 7.2. IP/Subnet and Profiling Graph Troubleshooting
  • 7.3. AS and Country Graph Troubleshooting
• 8. Configuration » General Settings » Custom Decoders
• 9. Configuration » General Settings » Anomaly Detection
• 10. Configuration » General Settings » Anomaly Mitigation
• 11. Configuration » Network & Policy » Response
  • 11.1. Extending the Built-in Actions
  • 11.2. Extending the Built-in Preconditions
• 12. Configuration » Network & Policy » IP Zone
• 13. Configuration » Servers
  • 13.1. Distributing the Software over Multiple Servers
  • 13.2. Server Troubleshooting
• 14. Configuration » Components » Packet Sensor
  • 14.1. Packet Sensor Troubleshooting
  • 14.2. Packet Sensor Optimization Steps for Intel XL710
  • 14.3. Packet Sensor Optimization Steps for Intel 82599
• 15. Configuration » Components » Flow Sensor
  • 15.1. Flow Sensor Troubleshooting
• 16. Configuration » Components » SNMP Sensor
  • 16.1. SNMP Sensor Troubleshooting
• 17. Configuration » Components » Sensor Cluster
• 18. Configuration » Components » BGP Connector
  • 18.1. BGP Connector for Quagga / FRR
  • 18.2. BGP Connector for ExaBGP
  • 18.3. BGP Connector Troubleshooting
• 19. Configuration » Components » Packet Filter
  • 19.1. Whitelist
  • 19.2. Packet Filter Troubleshooting
• 20. Configuration » Components » Flow Filter
• 21. Configuration » Components » Filter Cluster
• 22. Configuration » Schedulers » Scheduled Reports
• 23. Configuration » Schedulers » Event Reporting
• 24. Configuration » General Settings » Outgoing Email
• 25. Configuration » General Settings » User Management
• 26. Configuration » General Settings » User Authentication
• 27. Reports » Tools » Anomalies
  • 27.1. Active Anomalies
  • 27.2. Anomaly Archive
  • 27.3. Anomaly Overview
  • 27.4. Anomaly Distribution
• 28. Reports » Tools » Firewall
  • 28.1. Active Firewall Rules
  • 28.2. Filtering Rule Archive
  • 28.3. Filtering Rule Distribution
• 29. Reports » Tools » Routing
  • 29.1. Active BGP Announcements
  • 29.2. BGP Announcement Archive
  • 29.3. BGP Connector Events
• 30. Reports » Tools » Flows
  • 30.1. Flow Records
  • 30.2. Flow Tops
• 31. Reports » Tools » Packets
  • 31.1. Active Packet Dumps
  • 31.2. Packet Dump Archive
• 32. Reports » Devices » Overview
• 33. Reports » Devices » Sensors
  • 33.1. Sensor Dashboard
  • 33.2. Sensor Graphs
  • 33.3. Sensor Tops
  • 33.4. Sensor Events
  • 33.5. Anomaly Overview
  • 33.6. AS Graphs
  • 33.7. Country Graphs
  • 33.8. Flow Records
  • 33.9. Flow Tops
• 34. Reports » Devices » Filters
  • 34.1. Filter Dashboard
  • 34.2. Filter Graphs
  • 34.3. Filter Events
  • 34.4. Filter Instances
  • 34.5. Filtering Rules Archive
  • 34.6. Filtering Rules Distribution
• 35. Reports » Dashboards
• 36. Reports » IP Addresses & Groups
  • 36.1. IP Dashboard
  • 36.2. IP Graphs
  • 36.3. IP Accounting
  • 36.4. Anomaly Overview
  • 36.5. Profile Graphs
  • 36.6. Flow Records
  • 36.7. Flow Tops
• 37. Reports » Servers
  • 37.1. Console / Server Dashboard
  • 37.2. Console / Server Graphs
  • 37.3. Console Events
  • 37.4. Server Events
  • 37.5. Server Commands
• 38. Appendix 1 – DPDK Configuration
  • 38.1. Application Workflow
  • 38.2. DPDK Capture Engine Options
  • 38.3. DPDK Configuration Example
• 39. Appendix 2 – Configuring NetFlow Data Export
  • 39.1. Configuring NDE on older IOS Devices
  • 39.2. Configuring NDE on a CatOS Device
  • 39.3. Configuring NDE on a Native IOS Device
  • 39.4. Configuring NDE on a 4000 Series Switch
  • 39.5. Configuring NDE on IOS XE
  • 39.6. Configuring NDE on IOS XR
  • 39.7. Configuring NDE on IOS-XE Everest
  • 39.8. Configuring NDE on a Juniper Router (non-MX)
  • 39.9. Configuring NDE on a Juniper MX Router
• 40. Appendix 3 – BGP Black Hole Guideline for Wanguard Sensor
  • 40.1. Understanding of RTBH using Wanguard
  • 40.2. Black-holing on upstream
  • 40.3. Interaction with traffic diversion / Wanguard Filter
• 41. Appendix 4 – Network Integration Guideline for Wanguard Filter
  • 41.1. Understanding the Traffic Diversion Method
  • 41.2. Understanding the Traffic Forwarding Methods
• 42. Appendix 5 – Conditional Parameters & Dynamic Parameters
  • 42.1. Anomaly Parameters
  • 42.2. Time Parameters
  • 42.3. Overall Traffic Parameters
  • 42.4. Filter Parameters
  • 42.5. Filtering Rule Parameters