Configuring Attack Detection Exemption; Applying An Attack Defense Policy To An Interface - HPE FlexNetwork 10500 Series Security Configuration Manual

Step
7. Configure IP
address-specific HTTP
flood attack detection.

Configuring attack detection exemption

The attack defense policy uses the ACL to identify exempted packets. The policy does not check the
packets permitted by the ACL. You can configure the ACL to identify packets from trusted servers.
The exemption feature reduces the false alarm rate and improves packet processing efficiency. For
example, the attack defense policy identifies multicast packets with the same source addresses and
different destination addresses as scanning attack packets (for example, OSPF or PIM packets). You
can configure an ACL to exempt such packets from attack detection.
If an ACL is used for attack detection exemption, only the following match criteria in the ACL permit
rules take effect:
•
Source IP address.
•
Destination IP address.
•
Source port.
•
Destination port.
•
Protocol.
•
L3VPN instance.
•
The fragment keyword for matching non-first fragments.
To configure attack detection exemption:
Step
1. Enter system view.
2. Enter attack defense policy
view.
3. Configure attack detection
exemption.

Applying an attack defense policy to an interface

An attack defense policy does not take effect unless you apply it to an interface.
To apply an attack defense policy to an interface:
Step
1. Enter system view.
2. Enter system view.
3. Apply an attack defense
policy to the interface.
Command
http-flood detect { ip
ipv4-address | ipv6
ipv6-address } [ vpn-instance
vpn-instance-name ] [ port
port-list ] [ threshold
threshold-value ] [ action { { drop
| logging } * | none } ]
Command
system-view
attack-defense policy
policy-name
exempt acl [ ipv6 ] { acl-number
| name acl-name }
Command
system-view
interface interface-type
interface-number
attack-defense apply policy
policy-name
484
Remarks
By default, IP address-specific
HTTP flood attack detection is not
configured.
Remarks
N/A
N/A
By default, attack detection
exemption is not configured.
Remarks
N/A
N/A
By default, no attack defense policy
is applied to the interface.