Cisco SCE 8000 10GBE, Руководство по настройке программного обеспечения

Страница: 356 / 478

12-20
Cisco SCE 8000 10GBE Software Configuration Guide
OL-30621-02
Chapter 12 Identifying and Preventing Distributed Denial-of-Service Attacks
Subscriber Notifications
Subscriber Notifications
• Configuring the Subscriber Notification Port, page 12-20
•
How to Remove the Subscriber Notification Port, page 12-20
Subscriber notification is a capability used- for notifying a subscriber in real-time about current attacks
involving IP addresses mapped to that subscriber. Subscriber notification is configured on a
per-attack-detector level, as explained above, and must also be enabled and configured by the application
loaded to the Cisco SCE platform, as explained in the
Cisco Service Control Application for Broadband
User Guide .
In the current solutions, the Cisco SCE Platform notifies the subscriber about the attack by redirecting
HTTP flows originating from the subscriber to the service provider’s server, that should notify the
subscriber that he is under attack. This raises a question regarding TCP attacks originating from the
subscriber that are configured with block action. Such attacks cannot normally be notified to the
subscriber using HTTP redirection, since all HTTP flows originating from the subscriber are TCP flows,
and they are therefore blocked along with all other attack flows. To enable effective use of HTTP
redirect, there is a CLI command that prevents blocking of TCP flows originating from the subscriber to
a specified TCP port, even when the above scenario occurs.
Configuring the Subscriber Notification Port
You can define a port to be used as the subscriber notification port. The attack filter will never block TCP
traffic from the subscriber side of the Cisco SCE platform to this port, leaving it always available for
subscriber notification.
Options
The following option is available:
• portnumber— The number of the port to be used as the subscriber notification port
From the SCE(config if)# prompt, type:
How to Remove the Subscriber Notification Port
Commands Purpose
attack-filter subscriber-notification ports
portnumber
Defines a port to be used as the subscriber
notification port.
Commands Purpose
no attack-filter subscriber-notification ports Removes the subscriber notification port.