HP 10500 series, Security Configuration Manual

Page: 494 / 596

480
If you apply an attack defense policy to a global interface, specify a service card to process traffic for
the interface. If you do not specify a service card, the policy cannot correctly detect and prevent
scanning and flood attacks.
To apply an attack defense policy to an interface:
Step Command Remarks
1. Enter system view.
system-view N/A
2. Enter system view.
interface interface-type
interface-number
N/A
3. Apply an attack defense
policy to the interface.
attack-defense apply policy
policy-name
By default, no attack defense policy
is applied to the interface.
4. Specify a service card to
process traffic for the
interface.
service slot slot-number
Optional.
By default, no service card is
specified for the interface.
Applying an attack defense policy to the device
An attack defense policy applied to the device itself rather than the interfaces detects packets
destined for the device and prevents attacks targeted at the device.
A switch uses hardware to implement packet forwarding and uses software to process packets if the
packets are destined for the switch. The software does not provide any attack defense features, so
you can apply an attack defense policy to the switch to prevent attacks aimed at the switch.
Applying an attack defense policy to a device can improve the efficiency of processing attack
packets destined for the device.
If a device and its interfaces have attack defense policies applied, a packet destined for the device is
processed as follows:
1. The policy applied to the receiving interface processes the packet.
2. If the packet is not dropped by the receiving interface, the policy applied to the device
processes the packet.
To apply an attack defense policy to the device:
Step Command Remarks
1. Enter system view.
system-view
N/A
2. Apply an attack defense
policy to the device.
attack-defense local apply
policy
policy-name
By default, no attack defense policy
is applied to the device.
Enabling log non-aggregation for single-packet attack events
Log aggregation aggregates all logs generated in a period and sends one log. The logs with the
same attributes for the following items can be aggregated:
•
Interface where the attack is detected.
•
Attack type.
•
Attack defense action.
•
Source and destination IP addresses.
•
VPN instance to which the victim IP address belongs.