485
Task Command
Clear dynamic IPv4 blacklist entries.
reset blacklist
ip
{
source-ip-address
[
vpn-instance
vpn-instance-name
] [
ds-lite-peer
ds-lite-peer-address
] |
all
}
Clear dynamic IPv6 blacklist entries.
reset blacklist
ipv6
{
source-ipv6-address
[
vpn-instance
vpn-instance-name
] |
all
}
Clear blacklist statistics.
reset blacklist statistics
Attack detection and prevention configuration
examples
Interface-based attack detection and prevention
configuration example
Network requirements
As shown in
, the device is the gateway for the internal network.
Configure an attack defense policy and apply the policy to GigabitEthernet 1/0/2 to meet the
following requirements:
•
Provide low-level scanning attack detection for internal hosts and servers. If a scanning attack
is detected, log the attack and keep the attacker on the blacklist for 10 minutes.
•
Protect internal hosts and servers against smurf attacks. If a smurf attack is detected, log the
attack.
•
Protect the internal server against SYN flood attacks. If the number of SYN packets sent to the
server per second reaches or exceeds 5000, log the attack and drop subsequent packets.
Figure 140 Network diagram
Configuration procedure
# Configure IP addresses for the interfaces on the device. (Details not shown.)
# Enable the global blacklist feature.
<Device> system-view
[Device] blacklist global enable
Summary of Contents for 10500 series
Page 326: ...312 No duration limit for this SA ...