Topics

Anyone else experiencing this? Normally I get around 20k blocked IPs from the community but now it has been like this for several days. I have all available updates installed and haven't changed anything in the configuration.


crowdsecurity/community-blocklist   update : +32/-1 IPs         ban:32   
15 minutes ago
crowdsecurity/community-blocklist   update : +32/-1 IPs         ban:27   
2 hours ago
crowdsecurity/community-blocklist   update : +32/-0 IPs         ban:22   
4 hours ago
crowdsecurity/community-blocklist   update : +32/-1 IPs         ban:11   
6 hours ago

etc...

Hi,

When the packet engine starts, I usually get around 20-30ms response time to cloud node. However when the packet engine has been running for a few days, the response time doubles at some point and newer returns back to normal until the packet engine is restarted. I'm using Europe and Europe2 nodes.

This is not new behavior in my installation. I remember seeing this already long time ago but I hadn't had time to raise a question about it. Anyone else experiencing this?

On the Advanced Security policy we can see options for:

Block Botnet C&C (Coming soon)
Block Botnet DGA Domains (Coming soon)
Block DNS Tunneling (Coming soon)

Any information when these are actually coming?

I have several LAN clients, some are configured with static IP address from DHCP server and some are dynamic addresses. Problem is that sometimes when I add a new client to my network, it gets assigned a same IP address which is supposed to be reserved for a static client.

Workaround for this is to manually configure the DHCP server to assign a free static IP to the new client. This resolves the conflict but is extra work. I've never seen any of my previous gateways to assign conflicting addresses. Is this a bug or have I missed something with my dhcp configuration?

Hi.

I know the answer to my question might be something that SunnyValley is not able to disclose but I'm going to ask it anyway.

Who is the provider of threat intelligence and site classification for Zenarmor? Or is SunnyValley using a proprietary engine for this?

Reason for my question is because I currently use Brightcloud filtering on my Aruba instant on equipment, Suricata inspection with proofpoint rules in opnsense and finally a Quad 9 DNS inspection which uses multiple threat intelligence providers. So I'm wondering if using Zenarmor gives me any more defence layers especially if it uses the same threat intelligence than any of the providers that I'm currently using.