Configuration Task List - HP A6600 Configuration Manual

Bidirectional proxy
2.
Figure 135 Data exchange process in bidirectional proxy mode
TCP client
2) SYN ACK (win=0)
7) ACK (win=n)
After receiving a SYN message from a client to a protected server, the TCP proxy sends back a SYN
ACK message with the window size of 0 on behalf of the server. If the client is legitimate, the TCP proxy
receives an ACK message. Upon receiving an ACK message from the client, the TCP proxy sets up a
connection between itself and the server through a three-way handshake on behalf of the client. Thus,
two TCP connections are established, and the two connections use different sequence numbers.
In bidirectional proxy mode, the TCP proxy plays two roles: a virutal server that communicates with
clients and a vitual client that communicates with servers. To use this mode, you must deploy the TCP
proxy on the key path that passes through the ingress and egress of the protected servers. You must also
make sure that all packets that the clients send to the server and all packets that the servers send to the
clients pass through the TCP proxy device.

Configuration task list

The attack detection and protection configuration tasks fall into three categories:
Configuring attack protection functions for an interface. To do so, you must create an attack
•
protection policy, configure the required attack protection functions (such as Smurf attack
protection, scanning attack protection, and flood attack protection) in the policy, and then apply
the policy to the interface. There is no specific configuration order for the attack functions, and
configure them as needed.
Configuring a TCP proxy when the SYN flood attack protection policy specifies the processing
•
method for SYN flood attack packets as TCP proxy.
Configuring the blacklist function. This function can be used independently or in conjunction with
•
the scanning attack protection function on an interface.
Enabling the traffic statistics function. This function can be used independently.
•
TCP proxy
1) SYN
3) ACK
5) SYN ACK (win=n)
TCP server
4) SYN
6) ACK
391