Cisco 500 Series, Руководство по настройке

Страница: 433 / 1140

23-3
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 23 Preventing Network Attacks
Configuring Threat Detection
Step 2
(Optional) To change the default settings for one or more type of event, enter the following command:
hostname(config)# threat-detection rate { acl-drop | bad-packet-drop | conn-limit-drop |
dos-drop | fw-drop | icmp-drop | inspect-drop | interface-drop | scanning-threat |
syn-attack } rate-interval rate_interval average-rate av_rate burst-rate burst_rate
For a description of each event type, see the “Basic Threat Detection Overview” section on page 23-2 .
When you use this command with the scanning-threat keyword, it is also used in the scanning threat
detection feature (see the “Configuring Scanning Threat Detection” section). The rates you set in this
command determine when a host is considered to be an attacker or a target. If you do not set the rates
using this command, the default values are used for the scanning threat detection feature as well as the
basic threat detection feature. If you do not configure basic threat detection, you can still use this
command with the
scanning-threat keyword to configure the rate limits for scanning threat detection.
The rate-interface rate_interval argument is between 600 seconds and 2592000 seconds (30 days). The
rate interval is used to determine the length of time over which to average the drops. It also determines
the burst threshold rate interval (see below).
Table 23-1 Basic Threat Detection Default Settings
Packet Drop Reason
Trigger Settings
Average Rate Burst Rate
• DoS attack detected
•
Bad packet format
• Connection limits exceeded
•
Suspicious ICMP packets
detected
100 drops/sec over the last 600
seconds. 400 drops/sec over the last 10
second period.
80 drops/sec over the last 3600
seconds. 320 drops/sec over the last 60
second period.
Scanning attack detected 5 drops/sec over the last 600
seconds. 10 drops/sec over the last 10
second period.
4 drops/sec over the last 3600
seconds. 8 drops/sec over the last 60
second period.
Incomplete session detected such as
TCP SYN attack detected or no data
UDP session attack detected
(combined) 100 drops/sec over the last 600
seconds. 200 drops/sec over the last 10
second period.
80 drops/sec over the last 3600
seconds. 160 drops/sec over the last 60
second period.
Denial by access lists 400 drops/sec over the last 600
seconds. 800 drops/sec over the last 10
second period.
320 drops/sec over the last
3600 seconds. 640 drops/sec over the last 60
second period.
•
Basic firewall checks failed
• Packets failed application
inspection
400 drops/sec over the last 600
seconds. 1600 drops/sec over the last 10
second period.
320 drops/sec over the last
3600 seconds. 1280 drops/sec over the last 60
second period.
Interface overload 2000 drops/sec over the last
600 seconds. 8000 drops/sec over the last 10
second period.
1600 drops/sec over the last
3600 seconds. 6400 drops/sec over the last 60
second period.