
474
Step Command
Remarks
5.
(Optional.) Specify the
actions against
single-packet attacks of a
specific level.
signature level
{
high
|
info
|
low
|
medium
}
action
{ {
drop
|
logging
} *
|
none
}
The default action is
logging
for single-packet attacks of the
informational and low levels.
The default actions are
logging
and
drop
for
single-packet attacks of the
medium and high levels.
6.
(Optional.) Enable
signature detection for
single-packet attacks of a
specific level.
signature level
{
high
|
info
|
low
|
medium
}
detect
By default, signature detection
is disabled for all levels of
single-packet attacks.
Configuring a scanning attack defense policy
Apply a scanning attack defense policy to the interface that is connected to the external network.
Scanning attack detection inspects the incoming packet rate of connections to the target system. If a
source initiates connections at a rate equal to or exceeding the pre-defined threshold, the device can
take the following actions:
•
Output logs.
•
Drop subsequent packets from the IP address of the attacker.
•
Add the attacker's IP address to the IP blacklist.
To blacklist the attackers, you must enable the blacklist feature globally or on the interface where the
defense policy is applied. For more information about the blacklist, see "
To configure a scanning attack defense policy:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enter attack defense policy
view.
attack-defense policy
policy-name
N/A
3.
Configure scanning attack
detection.
scan detect level
{
high
|
low
|
medium
}
action
{ {
block-source
[
timeout
minutes
] |
drop
} |
logging
} *
By default, scanning attack
detection is not configured.
Configuring a flood attack defense policy
Apply a flood attack defense policy to the interface that is connected to the external network to
protect internal servers.
Flood attack detection monitors the rate at which connections are initiated to the internal servers.
With flood attack detection enabled, the device is in attack detection state. When the packet sending
rate to an IP address reaches the threshold, the device enters prevention state and takes the
specified actions. When the rate is below the silence threshold (three-fourths of the threshold), the
device returns to the attack detection state.
If a device has multiple service cards, the global trigger threshold you set takes effect on each
service card. The global trigger threshold of the device is the product of multiplying the value you set
by the service card quantity.
Summary of Contents for 10500 series
Page 326: ...312 No duration limit for this SA ...