Cisco Small Business 300 1.1 Series, Руководство администратора

Страница: 602 / 706

Quality of Service (QoS) Commands
78-20269-01 Command Line Interface Reference Guide 604
41
Since the hardware rate limiting counts bytes, it is assumed that the size of “SYN”
packets is short.
Example
The following example attempts to rate limit DoS SYN attacks on a port. It fails
because security suite is enabled globally and not per interface.
Console(config)# security-suite enable global-rules-only
Console(config)# interface gi1
Console(config-if)# security-suite dos syn-attack 199 any /10
To perform this command, DoS Prevention must be enabled in the per-interface mode.
41.46 security-suite deny martian-addresses
Use the security-suite deny martian-addresses Global Configuration mode
command to deny packets containing system-reserved IP addresses or
user-defined IP addresses.
Syntax
security-suite deny martian-addresses {add {ip-address {mask | /prefix-length}} |
remove {ip-address {mask | /prefix-length}} (
Add/remove user-specified IP
addresses)
security-suite deny martian-addresses reserved {add | remove} ( Add/remove
system-reserved IP addresses, see tables below)
no security-suite deny martian-addresses ( This command removes addresses
reserved by security-suite deny martian-addresses
{add {ip-address {mask |
/prefix-length}} | remove {ip-address {mask | /prefix-length}},
and removes all
entries added by the user.
The user can remove a specific entry by using remove ip-address {mask |
/prefix-length}
parameter.
There is no no form of the security-suite deny martian-addresses
reserved {add |
remove} command. Use instead the security-suite deny martian-addresses
reserved
remove
command to remove protection (and free up hardware
resources).