Displaying And Maintaining Attack Detection And Prevention - HP MSR Series Configuration Manual

Hardware
MSR954(JH296A/JH297A/JH299A)
MSR1002-4/1003-8S
MSR2003
MSR2004-24/2004-48
MSR3012/3024/3044/3064
MSR4060/4080
The blacklist feature filters packets sourced from IP addresses in blacklist entries.
Blacklist entries can be manually added or dynamically learned:
•
You can manually add a blacklist entry by using the blacklist ip or blacklist ipv6 command.
These entries do not age out by default. You can configure an aging time for each entry.
•
The device can automatically add blacklist entries when collaborating with the scanning attack
detection feature. Each dynamically learned blacklist entry has an aging time, which is user
configurable. Make sure the block-source keyword is specified as the scanning attack
prevention action for collaboration. For more information about the scanning attack detection
and prevention feature, see
To configure the blacklist feature:
Step
1. Enter system view.
2. (Optional.) Enable the
global blacklist feature.
3. Enter interface view.
4. Enable the blacklist
feature on the interface.
5. (Optional.) Add an IPv4
blacklist entry.
6. (Optional.) Add an IPv6
blacklist entry.
7. (Optional.) Enable logging
for the blacklist feature.
Displaying and maintaining attack detection and
prevention
Use the display commands in any view and the reset commands in user view.
To display and maintain attack detection and prevention:
Blacklist compatibility
No
Yes
Yes
Yes
Yes
Yes
"Configuring a scanning attack defense
Command
system-view
blacklist global enable
interface interface-type
interface-number
blacklist enable
blacklist ip source-ip-address
[ vpn-instance vpn-instance-name ]
[ timeout minutes ]
blacklist ipv6 source-ipv6-address
[ vpn-instance vpn-instance-name ]
[ ds-lite-peer ds-lite-peer-address ]
[ timeout minutes ]
blacklist logging enable
501
policy."
Remarks
N/A
By default, the global blacklist
feature is disabled.
If the global blacklist feature is
enabled, the blacklist feature is
enabled on all interfaces.
N/A
By default, the blacklist feature is
disabled on the interface.
By default, no IPv4 blacklist entry
exists.
By default, no IPv6 blacklist entry
exists.
By default, logging is disabled for
the blacklist feature.