HP 10500 series, Security Configuration Manual, Page: 496 / 596

482
Step Command Remarks
3. (Optional.) Add an IPv4
blacklist entry.
blacklist ip source-ip-address
[ vpn-instance vpn-instance-name ]
[ timeout minutes ]
By default, no IPv4 blacklist
entries exist.
4. (Optional.) Add an IPv6
blacklist entry.
blacklist ipv6 source-ipv6-address
[ vpn-instance vpn-instance-name ]
[ timeout minutes ]
By default, no IPv6 blacklist
entries exist.
5. (Optional.) Enable logging
for the blacklist feature.
blacklist logging enable
By default, logging is disabled for
the blacklist feature.
6. Enter interface view.
interface interface-type
interface-number
N/A
7. Enable the blacklist
feature on the interface.
blacklist enable
By default, the blacklist feature is
disabled on the interface.
Configuring login attack prevention
The login attack prevention feature detects a login DoS attack if a user fails the maximum number of
successive login attempts. The feature triggers the blacklist feature to add the user's IP to the
blacklist. Following login attempts from the user is blocked for the block period. For login attack
prevention to take effect, you must enable the global blacklist feature.
This feature can effectively prevent login DoS attacks.
To configure login attack prevention:
Step Command Remarks
1. Enter system view.
system-view N/A
2. Enable login attack
prevention.
attack-defense login enable
By default, login attack prevention
is disabled.
3. Set the maximum number
of successive login
failures.
attack-defense login max-attempt
max-attempt
The default value is three.
4. Set the block period
during which a login
attempt is blocked.
attack-defense login
block-timeout
minutes
The default value is 60 minutes.
5. Enable the global blacklist
feature.
blacklist global enable
By default, the global blacklist
feature is disabled.
Enabling the login delay
The login delay feature delays the device from accepting a login request from a user after the user
fails a login attempt. This feature can slow down login dictionary attacks.
The login delay feature is independent of the login attack prevention feature.
To enable the login delay:
Step Command Remarks
1. Enter system view.
system-view N/A