Skip to main content

Groups and Zones

Overview​

In rWeb, network routing and mitigation are managed by user-defined Zone(s). A Zone is a set of one more specified Destination IP subnets/prefixes. Zone configurations only apply to the subnets defined within a specific zone. All Zones are placed within Groups. No mitigation configurations in rWeb can be made on a Group; they are only made by Zone. All IP addresses for a network must belong to a Group > Zone. All unassigned Destination IP traffic received is reported and controlled under rWeb's Default Group / Default Zone configuration until a user assigns an associated prefix to a more specific Zone.

Default Group and Zone​

Initially, in a freshly installed or factory reset rWeb, all network IPs are automatically assigned to rWeb's Default Group / Default Zone. If a user doesn't otherwise specify Zones, all traffic will be mitigated according to the settings of the Default Group / Default Zone. This Default Group/Zone cannot be deleted from rWeb.

  1. The configuration for Default Group / Default Zone has a subnet IP of 0.0.0.0/0 for IPv4 and ::/0 for IPv6.
  2. New Zones will automatically inherit rWeb's Default Template settings until reconfigured by the user.
  3. The Default Group can hold the Default Zone as well as a number of new Zones.

What is a Group?​

A Group is a billing/reporting entity, that contains other Groups or Zones. Reports can be generated for each Group, all on their different schedules (to match their billing cycles). The Group identity is a searchable field, therefore allowing a service provider to effectively manage a large number of customers within rWeb.

A Group is identified by a Group ID that is alpha numeric, symbols including spaces. All identification is case sensitive and therefore, the name "riorey" is a different Group than "RioRey".

Each Group can hold a number of Zones. Groups can also contain children Groups, to facilitate management of sets of users with different destinations and permissions requirements.

What is a Zone?​

A Zone is a mitigation control entity. Zones are intended to simplify mitigation control efforts. Servers or services of similar nature are grouped together to form a Zone. A single set of mitigation controls is applied to a Zone. For example, if a customer has three web servers sourcing general static pages, you can add their IP addresses into the same Zone. During setup, all changes to mitigation settings will be applied to all three at the same time, therefore saving a lot of the effort of transferring mitigation settings from server to server.

A Zone is also identified by a Zone name that is alpha numeric, symbols including spaces. All identifications are case sensitive, and therefore the name "web" is a different zone than "WEB".

A Zone contains a set of IPs or IP subnets/prefixes. Subnets can be defined from /32 to /16 for IPv4, with no limitations on IPv6 addresses (/128 and up). IPv4 Subnets larger than /16 will need multiple subnet entries.

Zones with a more specific subnet override the controls of a zone with a less specific subnet. Zones can be "nested" so that you can apply tighter filtering controls without affecting other systems.

During an attack, victims are identified by the destination IP. If two destination IPs inside the same zone are under attack, both of these attacks will be reported in the same zone mitigation screen.

Steps to Configuring a Group and Zone in rWeb​

In order to successfully configure a Group / Zone in rWeb, the user must complete the following steps:

  1. Add a Group to the "Group and Zone" list in rWeb.
  2. Add a Zone to an existing Group within the "Group and Zone" list in rWeb.
  3. Set up Routing for the Zone (Assign IP/Subnets and RioRey Devices to zone).

Depending on requirements, there are two different ways to approach configuring your groups and zones:

  1. A flatter structure, familiar to users of previous versions of rWeb, with most groups at the top level and zones associated as needed. See more here.
  2. A hierarchical structure, where IP space and devices are provisioned to top level groups for further division and use by managed sets of users. See more here.