HP 10500 series, Security Configuration Manual

Page: 495 / 596

481
As a best practice, do not disable log aggregation. A large number of logs will consume the display
resources of the console.
To enable log non-aggregation for single-packet attack events:
Step Command Remarks
1. Enter system view.
system-view N/A
2. Enable log
non-aggregation for
single-packet attack
events.
attack-defense signature log
non-aggregate
By default, log non-aggregation is
disabled for single-packet attack
events.
Configuring TCP fragment attack prevention
The TCP fragment attack prevention feature detects the length and fragment offset of received TCP
fragments and drops attack TCP fragments.
TCP fragment attack prevention takes precedence over single-packet attack prevention. When both
are used, incoming TCP packets are processed first by TCP fragment attack prevention and then by
the single-packet attack defense policy.
To configure TCP fragment attack prevention:
Step Command Remarks
1. Enter system view.
system-view
N/A
2. Enable TCP fragment attack
prevention.
attack-defense tcp fragment
enable
By default, TCP fragment attack
prevention is enabled.
TCP fragment attack prevention is
typically used alone.
Configuring the IP blacklist feature
The IP blacklist feature filters packets sourced from IP addresses in blacklist entries.
IP blacklist entries can be manually added or dynamically learned:
•
You can manually add an IP blacklist entry by using the blacklist ip or blacklist ipv6 command.
These entries do not age out by default. You can set an aging time for each entry.
•
The device can automatically add IP blacklist entries when collaborating with scanning attack
detection. Each dynamically learned IP blacklist entry has an aging time, which is user
configurable. Make sure the
block-source keyword is specified as the scanning attack
prevention action. For more information about the scanning attack detection and prevention,
see "
Configuring a scanning attack defense policy ."
To configure the IP blacklist feature:
Step Command Remarks
1. Enter system view.
system-view N/A
2. (Optional.) Enable the
global blacklist feature.
blacklist global enable
By default, the global blacklist
feature is disabled.
If the global blacklist feature is
enabled, the blacklist feature is
enabled on all interfaces.