580
[Sysname-attack-defense-policy-atk-policy-1] rst-flood action drop
Related commands
rst-flood detect
rst-flood detect non-specific
rst-flood threshold
rst-flood detect
Use
rst-flood detect
to configure IP address-specific RST flood attack detection.
Use
undo rst-flood detect
to remove the IP address-specific RST flood attack detection
configuration.
Syntax
rst-flood detect
{
ip ipv4-address
|
ipv6 ipv6-address
} [
vpn-instance vpn-instance-name
]
[
threshold threshold-value
] [
action
{ {
drop
|
logging
} * |
none
} ]
undo rst-flood detect
{
ip ipv4-address
|
ipv6 ipv6-address
} [
vpn-instance vpn-instance-name
]
Default
IP address-specific RST flood attack detection is not configured.
Views
Attack defense policy view
Predefined user roles
network-admin
mdc-admin
Parameters
ip
ipv4-address
: Specifies the IPv4 address to be protected. The
ip-address
argument cannot be all
1s or 0s.
ipv6
ipv6-address
: Specifies the IPv6 address to be protected.
vpn-instance vpn-instance-name
: Specifies the MPLS L3VPN instance to which the protected IP
address belongs. The
vpn-instance-name
argument is a case-sensitive string of 1 to 31 characters.
Do not specify this option if the protected IP address is on the public network.
threshold
threshold-value
: Specifies the threshold for triggering RST flood attack prevention. The
value range is 1 to 1000000 in units of RST packets sent to the specified IP address per second.
action
: Specifies the actions when an RST flood attack is detected. If no action is specified, the
global actions set by the
rst-flood action
command apply.
drop
: Drops subsequent RST packets destined for the protected IP address.
logging
: Enables logging for RST flood attack events.
none
: Takes no action.
Usage guidelines
With RST flood attack detection configured for an IP address, the device is in attack detection state.
When the sending rate of RST packets to the IP address reaches the threshold, the device enters
prevention state and takes the specified actions. When the rate is below the silence threshold
(three-fourths of the threshold), the device considers returns to the attack detection state.
You can configure RST flood attack detection for multiple IP addresses in one attack defense policy.
