Adding or Editing an Emergency Policy

Scenario

Currently, you can create blacklist policies for CFW, WAF, and VPC security groups in SecMaster.

This topic describes how to add or edit an emergency policy.

Limitations and Constraints

• A maximum of 500 emergency policies can be added to a workspace for each user.
• If an IP address is added to the blacklist, CFW will block requests from that IP address without checking whether the requests are malicious.
• After an emergency policy is added, the IP address or IP address range cannot be modified.

Adding an Emergency Policy

1. Log in to the management console.
2. Click in the upper left corner of the page and choose Security & Compliance > SecMaster.
3. In the navigation pane, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 1 Workspace management page
   

4. In the navigation pane on the left, choose Risk Prevention > Policy management. On the displayed page, click the Emergency strategy tab.
   Figure 2 Emergency strategy page
   

5. On the Emergency strategy page, click Add. The page for adding policies slides out from the right of the page.
6. On the Add page, configure policy information.

   Table 1 Emergency policy parameters

   Parameter	Description
   Blocked Object	Enter one or more IP addresses or IP address ranges to be blocked. If there are multiple IP addresses or IP address ranges, separate them with commas (,). Example: Single IP address: 192.168.0.0 IP address range: 192.168.0.0/12
   Label	Label of a custom emergency policy.
   Operation Connection	Select the operation connection for the policy.
   Block Aging	Check whether the policy needs to be stopped. If you select Yes, set the aging time of the policy. For example, if you set the aging time to 180 days, the policy is valid within 180 days after the setting. After 180 days, the IP address or IP address range will not be blocked. If you select No, the policy is always valid and blocks the specified IP address or IP address range.
   Reason Description	Description of the custom policy.

7. Click OK.

Editing an Emergency Policy

After an emergency policy is added, the IP address or IP address range cannot be modified.

1. Log in to the management console.
2. Click in the upper left corner of the page and choose Security & Compliance > SecMaster.
3. In the navigation pane, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 3 Workspace management page
   

4. In the navigation pane on the left, choose Risk Prevention > Policy management. On the displayed page, click the Emergency strategy tab.
   Figure 4 Emergency strategy page
   

5. On the emergency policy management page, locate the row that contains the policy you want to edit and click Edit in the Operation column.
6. On the edit policy page, modify the policy information.

   Table 2 Emergency policy parameters

   Parameter	Description
   Blocked Object	After an emergency policy is added, its blocked object cannot be modified.
   Label	Label of a custom emergency policy.
   Operation Connection	Select the operation connection for the policy.
   Block Aging	Check whether the policy needs to be stopped. If you select Yes, set the aging time of the policy. For example, if you set the aging time to 180 days, the policy is valid within 180 days after the setting. After 180 days, the IP address or IP address range will not be blocked. If you select No, the policy is always valid and blocks the specified IP address or IP address range.
   Reason Description	Description of the custom policy.

7. Click OK.