Cisco Sx350, Cli Manual

Page: 271 / 1323

Denial of Service (DoS) Commands
Cisco Sx350 Ph. 2.2.5 Devices - Command Line Interface Reference Guide 270
10
switchxxxxxx(config)#
security-suite enable global-rules-only
switchxxxxxx(config)# interface
gi1
1
switchxxxxxx(config-if)#
security-suite deny syn add any /32 any
To perform this command, DoS Prevention must be enabled in the per-interface mode.
10.5 security-suite deny syn-fin
To drop all ingressing TCP packets in which both SYN and FIN are set, use the
security-suite deny syn-fin Global Configuration mode command.
To permit TCP packets in which both SYN and FIN are set, use the no form of this
command.
Syntax
security-suite deny syn-fin
no security-suite deny syn-fin
Parameters
This command has no arguments or keywords.
Default Configuration
The feature is disabled by default.
Command Mode
Global Configuration mode
Example
The following example blocks TCP packets in which both SYN and FIN flags are
set.
switchxxxxxx(config)# security-suite deny sin-fin