Configuring Attack Detection Exemption - HP MSR Series Configuration Manual

Step
7. Configure IP-specific DNS
flood attack detection.
Configuring an HTTP flood attack defense policy
Step
1. Enter system view.
2. Enter attack defense policy
view.
3. Enable HTTP flood attack
detection for non-specific IP
addresses.
4. Set the global trigger
threshold for HTTP flood
attack prevention.
5. (Optional.) Specify the
global ports to be protected
against HTTP flood attacks.
6. Specify global actions
against HTTP flood attacks.
7. Configure IP-specific HTTP
flood attack detection.

Configuring attack detection exemption

The attack defense policy uses the ACL to identify exempted packets. The policy does not check the
packets permitted by the ACL. You can configure the ACL to identify packets from trusted servers.
The exemption feature reduces the false alarm rate and improves packet processing efficiency. For
example, the attack defense policy identifies multicast packets with the same source addresses and
different destination addresses, such as OSPF or PIM packets, as scanning attack packets. You can
configure an ACL to exempt such packets from attack detection.
If an ACL is used for attack detection exemption, only the following match criteria in the ACL permit
rules take effect:
•
Source IP address.
•
Destination IP address.
•
Source port.
•
Destination port.
•
Protocol.
Command
dns-flood detect { ip ip-address |
ipv6 ipv6-address }
[ vpn-instance
vpn-instance-name ] [ port
port-list ] [ threshold
threshold-value ] [ action
{ { client-verify | drop | logging }
* | none } ]
Command
system-view
attack-defense policy
policy-name
http-flood detect non-specific
http-flood threshold
threshold-value
http-flood port port-list
http-flood action { client-verify |
drop | logging } *
http-flood detect { ip ip-address
| ipv6 ipv6-address }
[ vpn-instance
vpn-instance-name ] [ port
port-list ] [ threshold
threshold-value ] [ action
{ { client-verify | drop | logging }
* | none } ]
496
Remarks
By default, DNS flood attack
detection is not configured for any
IP address.
Remarks
N/A
N/A
By default, HTTP flood attack
detection is disabled for
non-specific IP addresses.
By default, the global trigger
threshold is 1000 for HTTP flood
attack prevention.
By default, HTTP flood attack
prevention protects port 80.
By default, no global action is
specified for HTTP flood attacks.
By default, HTTP flood attack
detection is not configured for any
IP address.