Client-Verify Tcp Enable - HP FlexNetwork MSR Series Command Reference Manual

client-verify tcp enable

Use client-verify tcp enable to enable TCP client verification on an interface.
Use undo client-verify tcp enable to disable TCP client verification on an interface.
Syntax
client-verify tcp enable [ mode { syn-cookie | safe-reset } ]
undo client-verify tcp enable
Default
TCP client verification is disabled on an interface.
Views
Interface view
Predefined user roles
network-admin
Parameters
mode: Specifies a working mode for TCP client verification. If you do not specify this keyword, the
SYN cookie mode is used.
syn-cookie: Specifies the SYN cookie mode. In this mode, bidirectional TCP proxy is enabled.
safe-reset: Specifies the safe reset mode. In this mode, unidirectional TCP proxy is enabled.
Usage guidelines
Enable TCP client verification on the interface connected to the external network to check incoming
packets. This feature protects internal servers against TCP flood attacks, including SYN flood
attacks, SYN-ACK flood attacks, RST flood attacks, FIN flood attacks, and ACK flood attacks.
For TCP client verification to collaborate with TCP flood attack prevention, specify client-verify as
the TCP flood attack prevention action. During collaboration, the device adds the victim IP address to
the protected IP list and verifies the untrusted sources if it detects a TCP flood attack. You can use
the display client-verify tcp protected ip command to display the protected IP list for TCP client
verification.
TCP client verification supports the following modes:
•
Safe reset—Enables unidirectional TCP proxy for packets only from TCP connection initiators.
•
SYN cookie—Enables bidirectional TCP proxy for packets from both TCP clients and TCP
servers.
Choose a TCP proxy mode according to the network scenarios.
•
If packets from clients pass through the TCP proxy device, but packets from servers do not,
specify the safe reset mode.
•
If packets from clients and servers both pass through the TCP proxy device, specify either safe
reset or SYN cookie.
Examples
# Enable TCP client verification in SYN cookie mode on interface GigabitEthernet 1/0/1.
<Sysname> system-view
[Sysname] interface gigabitethernet 1/0/1
[Sysname-GigabitEthernet1/0/1] client-verify tcp enable mode syn-cookie
Related commands
client-verify tcp protected ip
824