Applicable scenario

• Product: ZCF
• Component: Cloud
• Version: 4.4.x
• Region: resource pool
• Scope: all storage nodes
• Trigger: Designated vulnerability scanners continuously scan resource-pool hosts and source-address blocking is required.

Symptoms

• Scanner IPs are:
• 10.10.x
• 10.10.x
• 172.28.x
• 172.28.x
• The remediation directly prevents those scanner source addresses from continuing to scan hosts.

Determination method

1. Confirm that the blocked targets are designated scanner source IPs.
2. After rules are applied, check that these addresses can no longer access target hosts.
3. Restore global HA after the change.

Cause

This remediation does not require a software upgrade or a complex whitelist. It identifies four designated scanner sources and adds DROP rules on all storage nodes to block their scanning traffic.

Resolution

1. Preparation

• Risk level: low.
• Log in to the cloud-platform UI and disable global VM HA.
• Back up databases on both management nodes.

2. Back up the database
3. Run on both management nodes:

   zstack-ctl dump_mysql

• Expected result: A database rollback baseline is available.

3. Block scanner devices on all storage nodes
4. Run the following rules on all storage nodes:

   iptables -A INPUT -s 10.10.11.99 -j DROP
   iptables -A INPUT -s 10.10.11.98 -j DROP
   iptables -A INPUT -s 172.28.0.99 -j DROP
   iptables -A INPUT -s 172.28.0.98 -j DROP

• Expected result: The four scanner source addresses are blocked and cannot continue scanning target hosts.

2. Verify that the rules take effect according to the actual environment.

• Expected result: Scanner access is suppressed.

4. Completion
5. Re-enable global VM HA after the change.

• Expected result: The platform resumes its normal HA policy.

Verification

• Four corresponding DROP rules exist on target storage nodes.
• Scanner access to hosts is blocked.
• Global HA is enabled again.

Risks and rollback

• Risk: Incorrect source IP identification can block normal device access.
• Risk level: low.

Rollback

Delete the rules one by one:

iptables -D INPUT -s 10.10.11.99 -j DROP
iptables -D INPUT -s 10.10.11.98 -j DROP
iptables -D INPUT -s 172.28.0.99 -j DROP
iptables -D INPUT -s 172.28.0.98 -j DROP