Description

This article explains how to disable 'Action: Ignore' logs for the vNTD Segment IP in Corero.

Symptoms

During the incident, multiple 'Action: Ignore' logs were generated for the vNTD segment IP address, as observed in the Corero mitigation dashboard.

Solution

To disable 'Action: Ignore' logs for the vNTD Segment IP, update the CIDR Rule Policy configuration as follows:

1) Go to SWA Application → Mitigation → CIDR Rule Policy.

2) Click Edit, then set the action to Disabled for the relevant CIDR Rule Policy entry.

3) Refer to the table below for a comparison of actions supported by CIDR Rule Policy and Service Level Policy across different router types:

ActionJuniper MX/PTX RouterFlowSpec Router (via CMS)
BlockSends a discard filter term.Sends a discard FlowSpec route instruction.
DetectSends an accept filter term.No action sent; event is logged.
RedirectSends a next-ip(6) filter term using the redirect IP (not supported on PTX).Sends a redirect instruction using the redirect IP.
PolicerSends a policer filter term using the policer name (e.g., limit_100000).Sends a rate-limit instruction based on the numerical value in the policer name.
DisabledNo action sent; no logs generated.No action sent; no logs generated.
IgnoreNo action sent; event is logged.No action sent; event is logged.


Modification History

2025-11-03 : Article Created