HP FlexNetwork 7500 Series, Справочник по командам

Страница: 538 / 738

523
Usage guidelines
With global ACK flood attack detection configured, the device is in attack detection state. When the
sending rate of ACK packets to an IP address reaches the threshold, the device enters prevention
state and takes the specified actions. When the rate is below the silence threshold (three-fourths of
the threshold), the device returns to the attack detection state.
The global threshold applies to global ACK flood attack detection. Adjust the threshold according to
the application scenarios. If the number of ACK packets sent to a protected server, such as an HTTP
or FTP server, is normally large, set a large threshold. A small threshold might affect the server
services. For a network that is unstable or susceptible to attacks, set a small threshold.
Examples
# Set the global threshold to 100 for triggering ACK flood attack prevention in attack defense policy
atk-policy-1 .
<Sysname> system-view
[Sysname] attack-defense policy atk-policy-1
[Sysname-attack-defense-policy-atk-policy-1] ack-flood threshold 100
Related commands
ack-flood action
ack-flood detect
ack-flood detect non-specific
attack-defense local apply policy
Use attack-defense local apply policy to apply an attack defense policy to the device.
Use undo attack-defense local apply policy to restore the default.
Syntax
attack-defense local apply policy policy-name
undo attack-defense local apply policy
Default
No attack defense policy is applied to the device.
Views
System view
Predefined user roles
network-admin
mdc-admin
Parameters
policy-name : Specifies an attack defense policy by its name. The policy name is a case-insensitive
string of 1 to 31 characters. Valid characters include uppercase and lowercase letters, digits,
underscores (_), and hyphens (-).
Usage guidelines
An attack defense policy applied to the device itself detects packets destined for the device and
prevents attacks targeted at the device.
A switch uses hardware to implement packet forwarding and uses software to process packets if the
packets are destined for the switch. The software does not provide any attack defense features, so
you must apply an attack defense policy to the switch to prevent attacks aimed at the switch.