Huawei AR1200-S Series, Configuration Manual, Page: 184 / 308

After attack source tracing is enabled, you can set the threshold for attack source tracing.
When the number of protocol packets sent from an attack source in a given period exceeds
the threshold, the AR1200-S traces and logs the attack source to notify the administrator.
l Alarm function for attack source tracing
After the alarm function for attack source tracing is enabled, you can set the alarm threshold
for attack source tracing. If the number of protocol packets sent from an attack source in a
given period exceeds the alarm threshold, an alarm is generated to notify the administrator.
CPU attack defense limits the rate of all the packets sent to the CPU to protect the CPU. CPU
attack defense provides the following functions:
l Blacklist
A blacklist refers to a group of unauthorized users. To defend against malicious attacks,
the AR1200-S adds users with a specific characteristic to a blacklist by using ACL rules
and discards the packets sent from the users in the blacklist.
l Rate limit
The rate limit function limits the rate of packets sent to the CPU. The AR1200-S sets
different rate limits for packets of different types or discards packets of a certain type to
protect the CPU.
l
Priority for packets of a specified protocol
The AR1200-S schedules packets sent to the CPU based on priorities of protocol packets
to ensure that packets with higher protocol priorities are processed first.
l Rate limit
The AR1200-S can limit the rate of all the packets sent to the CPU to protect the CPU.
l ALP
Active link protection (ALP) protects session-based application layer data, including data
of HTTP Sessions, FTP sessions. It ensures non-stop transmission of these services when
attacks occur.
When the AR1200-S detects setup of an HTTP session, an FTP session, ALP is enabled to
protect the session. The packets matching characteristics of the session are sent at a high
rate; therefore, reliability and stability of session-related services are ensured.
9.3 Configuring Attack Source Tracing
The attack source tracing function checks for attack packets sent to the CPU and notifies users
by sending logs or alarms.
Applicable Environment
A large number of attack packets may attack the CPUs of network devices. Attack source tracing
checks attack packets sent to the CPU and notifies the administrator by sending logs or alarms
so that the administrator can take measures to defend against attacks.
Procedure
Step 1
Run:
system-view
The system view is displayed.
Huawei AR1200-S Series Enterprise Routers
Configuration Guide - Security
9 Local Attack Defense Configuration
Issue 02 (2012-03-30) Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
170