Starting and Stopping Threat Protection Service

After you install the Threat Protection licenses on the appliance, you can start the threat protection service so you can monitor and mitigate DNS threats on that appliance.
To start or stop threat protection service:

From the Grid tab, select the Grid Manager tab -> Services tab, click the Threat Protection service link, and then select the member checkbox.
From the Toolbar, click Start to start the service or Stop to stop the service.

Note that when you stop threat protection service, the appliance does not provide visibility or protection against network floods or DNS threats. After you enable threat protection service, you can configure rule settings, add custom rules, and evaluate system rules to ensure that mitigation to DNS threats is handled properly. You can also temporary disable the threat protection service when necessary. For information about how to configure Grid security settings, see Configuring Grid Security Properties.

Note

Starting the threat protection service may cause a change in BIND behaviour in handling multiple TCP DNS queries from the same client. To avoid this, you can disable multiple DNS requests by selecting the Disable multiple DNS requests via single TCP session checkbox. For more information see, Enabling Multiple DNS Requests through a Single TCP Session.

Note that under normal circumstances when the system is not experiencing any attack, enabling the threat protection service may have a significant performance impact. When the system is under attack, enabling the threat protection service may have a higher performance impact. You might also notice a significant increase in the memory usage due to the threat protection service. You cannot replicate Grid, member, and profile by level threat protection configuration changes during a scheduled full upgrade.