(Optional) Configuring the Defense Group

Defense Group Overview

• The detecting device and cleaning device can be added to a defense group. In a defense group, the detecting device reports anomaly traffic to the ATIC Management center, and the ATIC Management center delivers a traffic diversion task to the cleaning device. Then the cleaning device performs traffic diversion and cleaning.

• When two or more detecting devices exist on the network, add them into a defense group and select a working mode, load redundancy or load sharing.

NOTE:

If a detecting device not in any defense group detects abnormal traffic, the device will divert the traffic to cleaning devices that do not belong to any defense group.

Management Operation

Choose Defense > Network Settings > Defense Group, and manage defense groups.

Create	Click to create a defense group. For details, see Creating a Defense Group.
Modify	Click of the defense group to be modified to modify the defense group.
Delete	Delete one defense group: Click in the Operation column to delete the corresponding defense group. Delete defense groups in batches: Select the check boxes of multiple defense groups and click above the list to delete the selected defense groups. Select the check box on the title bar and click above the list to delete all defense groups.
View	Click the name of the defense group to be viewed for its basic information and device information. Click Close to close the dialog box.

Creating a Defense Group

1. Choose Defense > Network Settings > Defense Group.
2. On the Defense Group List page, click .
3. Set the basic parameters of the defense group. For details, see Table 1.

   Table 1 Defense group parameters

   Parameter	Description	Value
   Name	Indicates the name of the defense group.	The collector name contains a maximum of 64 characters. It cannot contain any spaces or characters such as "'", "|", "\", ",", "<", ">", "&", ";", """, and "%". The value cannot be null (case insensitive).
   Detecting Mode	Indicates the detecting mode when two or more detecting devices work together.	If two or more detecting devices are adopted for collaboration, you need to select the value of this parameter. In other cases, skip this item. The following detecting modes are available: Load Sharing In load sharing mode, all detecting devices detect traffic collectively. This mode applies to heavy traffic scenarios and poses high requirements on device performance. Reports cover the total traffic of all detecting devices. Load Redundancy In load redundancy mode, detecting devices detect the same traffic (by mirroring or optical splitting), improving detection reliability. Reports cover the traffic of only one of the detecting devices.
   Description	Indicates remarks information for identifying a defense group.	The value contains a maximum of 255 characters.

4. Select devices to be added to the defense group.
   1. In the Select Device group box, click .
   2. On the Select Device page that is displayed, select the check box of an device and click OK.

      After successfully added, the device is displayed in the device list on the Create Defense Group page.

      NOTE:

      • Each device can be added to only one defense group.
      • In the device list, you can select an device and click to delete the device; you can select the check box on the title bar and click to delete all devices.

5. On the Create Defense Group page, click OK.

Configuring Coordinated Traffic Diversion

1. Choose Defense > Network Settings > Defense Group.
2. Select the defense groups and click .
3. Set related parameters on the Configure upstream coordination page.
   • Upstream coordination: You can enable or disable upstream coordination.
   • Coordinated upstream defense group: Choose a defense group from the drop-down list as the coordinated upstream device.

4. Click OK.