HPE FlexNetwork 7500 Series Security Configuration Manual page 410

•
Provide low-level scanning attack detection for internal hosts and servers. If a scanning attack
is detected, log the attack and keep the attacker on the blacklist for 10 minutes.
•
Protect internal hosts and servers against smurf attacks. If a smurf attack is detected, log the
attack.
•
Protect the internal server against SYN flood attacks. If the number of SYN packets sent to the
server per second reaches or exceeds 5000, log the attack and drop subsequent packets.
Figure 111 Network diagram
Host A
Host C
Configuration procedure
# Configure IP addresses for the interfaces on the device. (Details not shown.)
# Enable the global blacklist feature.
<Device> system-view
[Device] blacklist global enable
# Create attack defense policy a1.
[Device] attack-defense policy a1
# Configure signature detection for smurf attacks, and specify logging as the prevention action.
[Device-attack-defense-policy-a1] signature detect smurf action logging
# Configure low-level scanning attack detection, specify logging and block-source as the
prevention actions, and set the blacklist entry aging time to 10 minutes.
[Device-attack-defense-policy-a1] scan detect level low action logging block-source
timeout 10
# Configure SYN flood attack detection for 10.1.1.2, set the attack prevention triggering threshold to
5000, and specify logging and drop as the prevention actions.
[Device-attack-defense-policy-a1] syn-flood detect ip 10.1.1.2 threshold 5000 action
logging drop
[Device-attack-defense-policy-a1] quit
# Apply attack defense policy a1 to GigabitEthernet 1/0/2.
[Device] interface gigabitethernet 1/0/2
[Device-GigabitEthernet1/0/2] attack-defense apply policy a1
[Device-GigabitEthernet1/0/2] quit
Verifying the configuration
# Verify that attack defense policy a1 is successfully configured.
[Device] display attack-defense policy a1
Attack-defense Policy Information
Host B
Device
GE1/0/1
192.168.1.1/16
Server
10.1.1.2/24
GE1/0/2
202.1.0.1/16
Internet
GE1/0/3
10.1.1.1/24
396
Attacker
Host D
5.5.5.5/24