HP MSR Series Configuration Manual page 507

You can configure flood attack detection and prevention for a specific IP address. For non-specific IP
addresses, the device uses the global attack prevention settings.
Configuring a SYN flood attack defense policy
Step
1. Enter system view.
2. Enter attack defense policy
view.
3. Enable SYN flood attack
detection for non-specific IP
addresses.
4. Set the global trigger
threshold for SYN flood
attack prevention.
5. Specify global actions
against SYN flood attacks.
6. Configure IP-specific SYN
flood attack detection.
Configuring an ACK flood attack defense policy
Step
1. Enter system view.
2. Enter attack defense policy
view.
3. Enable ACK flood attack
detection for non-specific IP
addresses.
4. Set the global trigger
threshold for ACK flood
attack prevention.
5. Specify global actions
against ACK flood attacks.
6. Configure IP-specific ACK
flood attack detection.
Configuring a SYN-ACK flood attack defense policy
Step
1. Enter system view.
Command
system-view
attack-defense policy
policy-name
syn-flood detect non-specific
syn-flood threshold
threshold-value
syn-flood action { client-verify |
drop | logging } *
syn-flood detect { ip ip-address |
ipv6 ipv6-address }
[ vpn-instance
vpn-instance-name ] [ threshold
threshold-value ] [ action
{ { client-verify | drop | logging }
* | none } ]
Command
system-view
attack-defense policy
policy-name
ack-flood detect non-specific
ack-flood threshold
threshold-value
ack-flood action { client-verify |
drop | logging } *
ack-flood detect { ip ip-address |
ipv6 ipv6-address }
[ vpn-instance
vpn-instance-name ] [ threshold
threshold-value ] [ action
{ { client-verify | drop | logging }
* | none } ]
Command
system-view
492
Remarks
N/A
N/A
By default, SYN flood attack
detection is disabled for
non-specific IP addresses.
By default, the global trigger
threshold is 1000 for SYN flood
attack prevention.
By default, no global action is
specified for SYN flood attacks.
By default, SYN flood attack
detection is not configured for any
IP address.
Remarks
N/A
N/A
By default, ACK flood attack
detection is disabled for
non-specific IP addresses.
By default, the global trigger
threshold is 1000 for ACK flood
attack prevention.
By default, no global action is
specified for ACK flood attacks.
By default, ACK flood attack
detection is not configured for any
IP address.
Remarks
N/A