479
Step Command
Remarks
4.
Set the global trigger
threshold for HTTP flood
attack prevention.
http-flood threshold
threshold-value
The default setting is 1000.
5.
(Optional.) Specify the
global ports to be protected
against HTTP flood attacks.
http-flood port
port-list
By default, HTTP flood attack
prevention protects port 80.
6.
Specify global actions
against HTTP flood attacks.
http-flood action
{
drop
|
logging
} *
By default, no global action is
specified for HTTP flood attacks.
7.
Configure IP
address-specific HTTP
flood attack detection.
http-flood
detect
{
ip
ipv4-address
|
ipv6
ipv6-address
} [
vpn-instance
vpn-instance-name
] [
port
port-list
] [
threshold
threshold-value
] [
action
{
drop
|
logging
} * ]
By default, IP address-specific
HTTP flood attack detection is not
configured.
Configuring attack detection exemption
The attack defense policy uses the ACL to identify exempted packets. The policy does not check the
packets permitted by the ACL. You can configure the ACL to identify packets from trusted servers.
The exemption feature reduces the false alarm rate and improves packet processing efficiency. For
example, the attack defense policy identifies multicast packets with the same source addresses and
different destination addresses as scanning attack packets (for example, OSPF or PIM packets). You
can configure an ACL to exempt such packets from attack detection.
If an ACL is used for attack detection exemption, only the following match criteria in the ACL permit
rules take effect:
•
Source IP address.
•
Destination IP address.
•
Source port.
•
Destination port.
•
Protocol.
•
L3VPN instance.
•
fragment
keyword for matching non-first fragments.
To configure attack detection exemption:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enter attack defense policy
view.
attack-defense policy
policy-name
N/A
3.
Configure attack detection
exemption.
exempt acl
[
ipv6
]
{
acl-number
|
name
acl-name
}
By default, attack detection
exemption is not configured.
Applying an attack defense policy to an interface
An attack defense policy does not take effect unless you apply it to an interface.
Summary of Contents for 10500 series
Page 326: ...312 No duration limit for this SA ...
