Configuring The Ip Blacklist Feature; Configuring The User Blacklist Feature - HPE FlexNetwork 10500 Series Security Configuration Manual

Step
1. Enter system view.
2. Enable TCP fragment attack
prevention.

Configuring the IP blacklist feature

The IP blacklist feature filters packets sourced from IP addresses in blacklist entries.
IP blacklist entries can be manually added or dynamically learned:
•
You can manually add an IP blacklist entry. These entries do not age out by default. You can set
an aging time for each entry.
•
The device can automatically add IP blacklist entries when collaborating with scanning attack
detection. Each dynamically learned IP blacklist entry has an aging time, which is user
configurable. Make sure the block-source keyword is specified as the scanning attack
prevention action. For more information about the scanning attack detection and prevention,
see "Configuring a scanning attack defense
To configure the IP blacklist feature:
Step
1. Enter system view.
2. (Optional.) Enable the
global blacklist feature.
3. (Optional.) Add an IPv4
blacklist entry.
4. (Optional.) Add an IPv6
blacklist entry.
5. (Optional.) Enable logging
for the blacklist feature.

Configuring the user blacklist feature

The user blacklist feature filters packets sourced from users in blacklist entries.
A user blacklist entry can only be manually added by using the blacklist user command. A user
blacklist entry does not age out by default. You can set an aging time for the entry.
The user blacklist feature must be used together with the user identification feature. For more
information about user identification, see "Configuring user identification."
To configure the user blacklist feature:
Command
system-view
attack-defense tcp fragment
enable
policy."
Command
system-view
blacklist global enable
blacklist ip source-ip-address
[ vpn-instance vpn-instance-name ]
[ timeout minutes ]
blacklist ipv6 source-ipv6-address
[ vpn-instance vpn-instance-name ]
[ timeout minutes ]
blacklist logging enable
486
Remarks
N/A
By default, TCP fragment attack
prevention is enabled.
TCP fragment attack prevention is
typically used alone.
Remarks
N/A
By default, the global blacklist
feature is disabled.
If the global blacklist feature is
enabled, the blacklist feature is
enabled on all interfaces.
By default, no IPv4 blacklist
entries exist.
By default, no IPv6 blacklist
entries exist.
By default, logging is disabled for
the blacklist feature.