Traffic Filtering Priorities, Categories, and Protection Levels
Configure Traffic Filtering in a CloudConnexa Shield Policy — choose Per Priority (Monitor Only, Critical, Critical and High, or Critical/High/Medium IPS) or Per Category to select individual threat types. Traffic Filtering inspects tunneled traffic only and is switched on or off per policy.
Overview
Traffic filtering inspects tunneled traffic only, comparing it to traffic signatures associated with malicious activity and other traffic of interest. It classifies matching traffic by threat priority and category.
Configure Traffic Filtering per Shield Policy on the policy's Traffic Filtering tab. You can switch Traffic Filtering on or off for each policy and choose how threats are monitored and blocked.
Traffic Filtering provides two configuration modes:
Per Priority: Select a Protection Level based on threat severity.
Per Category: Select individual threat categories to block.
Traffic Filtering uses an Intrusion Detection System (IDS) to monitor threats and an Intrusion Prevention System (IPS) to block threats.
The Default Policy and custom Shield Policies use the same Traffic Filtering settings. Refer to About Shield Policies and About the Default Policy to understand how policies apply to User Groups, Networks, and Hosts.
Mode | When to use it |
|---|---|
Per Priority | Apply blocking based on threat severity across all categories. |
Per Category | Apply blocking based on specific threat types, regardless of priorities within the selected categories. |
Threat priorities
Traffic Filtering classifies matching traffic into three threat priority levels:
Critical
High
Medium
Threat categories can contain one or more priority levels. When you configure Traffic Filtering Per Priority, the selected Protection Level applies to matching traffic at those priority levels across all nine threat categories.
Configure filtering Per Priority
Select Per Priority to monitor or block traffic based on threat severity.
On the policy's Traffic Filtering tab, select one of these Protection Levels:
Protection Level | Behavior |
|---|---|
Monitor Only (IDS) | Monitors matching traffic without blocking it. |
Critical (IPS) | Monitors matching traffic and blocks threats with a Critical priority. |
Critical and High (IPS) | Monitors matching traffic and blocks threats with Critical or High priority. |
Critical, High, and Medium (IPS) | Monitors matching traffic and blocks threats with Critical, High, or Medium priority. |
For information about accessing and configuring the Traffic Filtering tab, refer to Create or Edit a Shield Policy.
Configure filtering Per Category
Select Per Category to choose the types of threats you want Traffic Filtering to block.
With Per Category, you can:
Select individual threat categories.
Search for a threat category by name.
Unselected categories are still monitored.
Important
Selecting a category includes all of its priorities. For example, selecting a category containing Critical, High, and Medium threats applies the selected filtering behavior to all three priority levels within that category.
Threat categories
Traffic Filtering classifies matching traffic into nine categories based on traffic or threat type. Each category contains traffic signatures associated with one or more threat priorities.
When using Per Category, selecting a category includes all threat priorities listed for that category.
Threat category | Threat priorities |
|---|---|
Adware | Medium |
Cryptojacking | Medium |
Denial of Service | High |
Intrusion Activity | Critical, High, Medium |
Known Threats | High, Medium |
Malware and Ransomware | Critical |
Phishing | High |
Tor | Medium |
Vulnerabilities/Exploits | High, Medium |