456
Configuring an attack defense policy
Creating an attack defense policy
An attack defense policy can contain a set of attack detection and prevention configuration against
multiple attacks.
To create an attack defense policy:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Create an attack defense
policy and enter its view.
attack-defense policy
policy-name
By default, no attack defense policy
exists.
Configuring a single-packet attack defense policy
Single-packet attack detection inspects packets destined for the device based on the packet
signature. If an attack packet is detected, the device can take the following actions:
•
Output logs (the default action).
•
Drop attack packets.
You can also configure the device to not take any actions.
To configure a single-packet attack defense policy:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enter attack
defense policy view.
attack-defense policy policy-name
N/A
3.
Configure signature
detection for
single-packet
attacks.
•
signature
detect
{
fraggle
|
fragment
|
impossible
|
ip-option-abnormal
|
land
|
large-icmp
|
large-icmpv6
|
ping-of-death
|
smurf
|
snork
|
tcp-all-flags
|
tcp-fin-only
|
tcp-invalid-flags
|
tcp-null-flag
|
tcp-syn-fin
|
teardrop
|
tiny-fragment
|
traceroute
|
udp-bomb
|
winnuke
} [
action
{ {
drop
|
logging
} *
|
none
} ]
•
signature detect
icmp-type
{
icmp-type-value
|
address-mask-reply
|
address-mask-request
|
destination-unreachable
|
echo-reply
|
echo-request
|
information-reply
|
information-request
|
parameter-problem
|
redirect
|
source-quench
|
time-exceeded
|
timestamp-reply
|
timestamp-request
}
[
action
{ {
drop
|
logging
} *
|
none
} ]
•
signature detect icmpv6-type
{
icmpv6-type-value
|
destination-unreachable
|
echo-reply
|
echo-request
|
group-query
|
group-reduction
|
group-report
|
packet-too-big
|
parameter-problem
|
time-exceeded
} [
action
{ {
drop
|
logging
} * |
none
} ]
•
signature detect
ip-option
{
option-code
|
internet-timestamp
|
loose-source-routing
|
By default, signature
detection is not
configured for
single-packet attacks.
You can configure
signature detection for
multiple single-packet
attacks.
