Adding a Zone

Procedure

1. Choose Defense > Policy Settings > Zone.
2. On the Zone List page, click .
3. Set the basic parameters of the Zone. For details, see Table 1.

   Table 1 Zone Basic Information

   Parameter	Description	Value
   Account	Indicates the Zone account that will be delivered to the device.	The Zone account consists of letters, digits, and underscores (_) and must start with a letter. It can neither be any illegitimate characters such as null, default and admin nor start with sig. It is case insensitive. Its length cannot exceed 32 characters. This parameter cannot be changed during Zone modification.
   Type	Indicates the Zone type.	The value can be User-Defined or Default. This parameter cannot be changed during Zone modification.
   Name	Indicates the Zone name, as a supplement of Zone account for query convenience. It is only for display on the ATIC.	The Zone name contains a maximum of 64 characters. It cannot be null. It can contain letters, digits and special characters"-","_","!","@","#","$","^",".","+","{","}".
   Contact, Phone, Mobile Phone, Post Code, Industry, Email address, Address	Indicates the basic information of the contact person.	-
   Description	Indicates the detailed description on the Zone.	Its length cannot exceed 255 characters.

4. Set the IP address of the user-defined Zone.
   NOTE:

   This operation can be performed only when a user-defined Zone is added.
   1. On the Create Zone page, click the IP Address tab.
   2. Click .

      

   3. Create IP addresses. For details on the parameters, see Table 2.
      NOTE:

      Both IPv4 and IPv6 addresses are applicable.

      Table 2 Creating IP addresses

      Parameter	Description	Value
      IP Type	Indicates the IP address type.	regular: The IP address belongs to this Zone. exclude: The IP address is excluded from this Zone. For example, if a Zone is a subnet except one IP address, you can configure a subnet whose IP Type is set to regular and an IP address whose IP Type is set to exclude.
      Create Mode	Indicates the mode of creating IP addresses.	IP address+Mask: The IP address and mask are entered to create IP addresses. IP address segment: The start and end IP addresses are entered to create IP addresses.

   4. Click OK.

      The new IP address is displayed in the IP Address list.

      NOTE:

      • The IP addresses of different Zones must be mutually exclusive.

      • In the IP Address list, you can select an IP address and click to delete the IP address; you can select the check box on the title bar and click to delete all IP addresses.

5. Click the Devices tab to associate devices with the Zone. Select the check box of an device and click OK.
   NOTE:

   To divert the traffic destined for a Zone to a specific VPN instance of the device, select the VPN instance in the VPN column.

6. Click the Policy tab to configure a defense policy and traffic diversion.
   1. Configure the protected bandwidth of the Zone.

      The Zone bandwidth refers to the total bandwidth of all IP addresses in the created Zone. It usually appears in operation scenarios and refers to the total bandwidth a carrier offers to its tenants.

      The protected bandwidth also provides reference to the alarm severity definition. Various Zones correspond to different bandwidths and alarm severity.

   2. Select a defense policy template.

      You can use the default defense policy template or create a defense policy template. For details, see Configuring Policy Templates.

   3. Select Capture attack packets. Then the cleaning device captures the packets discarded due to attacks upon the Zone. This assists in analyzing attack events (outbound not supported).
   4. Optional: Create a static traffic diversion task.

      In the Traffic Diversion Task List group box, click to create IP addresses whose traffic is to be diverted.

      After a static traffic diversion task is delivered, all traffic destined for the IP address is diverted to the cleaning device.

      When you specify certain IP addresses or IP address segments for traffic diversion in a protected IP address segment, split the IP address segment and select the subnet after splitting.

      1. Click of the IP address to be split.

      2. On the Splitting Setting page, enter the mask splitting length and click Split.

         The mask splitting length ranges from 1+number of mask bits to 8+number of mask bits. For example, the mask of a protected IP address segment is 255.255.0.0. That is, the number of mask bits is 16. In this case, the mask splitting length ranges from 17 to 24.

      3. Selects subnet IP addresses after splitting.

      4. Click OK.

      5. Select a subnet IP address after splitting on the Create Traffic Diversion Task page.

7. Optional: Click the Port Mapping tab to configure port mapping to fix a service at a certain protocol when service traffic exists on a non-well-known port (applicable to the AntiDDoS).
   NOTE:

   Each protocol of each Zone can be configured with 16 port mappings.
   1. Click to configure port mapping.

      

   2. Click OK.
8. Optional: Click the Associated Intelligent Rule tab and configure an intelligent defense rule (applicable to the AntiDDoS).
   1. Click and select an intelligent defense rule.

      

   2. Click OK.
9. Click OK to complete the Zone adding on ATIC Management center. Click Deploy to deploy the Zone configuration to devices.