Table of Contents
Advertisement
S9700 Core Routing Switch
Configuration Guide - SPU
These logs help you find out security risks, detect attempts to violate security policies, and learn
the type of a network attack. The real-time log is also used to detect an intrusion that is underway.
Traffic Statistics and Monitoring
A firewall monitors data traffic and detects connection setup between internal and external
networks, generates statistics, and analyzes data. The firewall can analyze the logs by using
special software after events occur. The firewall also has analysis functions that enable it to
analyze data in real time.
By checking whether the number of TCP/UDP sessions initiated from external networks to the
internal network exceeds the threshold, the firewall determines whether to restrict new sessions
from external networks to the internal network or restrict new sessions from an IP address in the
internal network. If the firewall finds that the number of sessions in the system exceeds the
threshold, it speeds up the aging of sessions. This ensures that new sessions are set up. In this
way, a DoS attack can be prevented if the system is too busy.
Figure 2-1
enabled for the packets from external networks to the internal network. If the number of TCP
sessions initiated by external networks to Web server 129.9.0.1 exceeds the threshold, the
SPU forbids external networks to initiate new sessions until the number of sessions is smaller
than the threshold.
Figure 2-1 Limiting the number of sessions initiated by external server
Attack Defense
With the attack defense feature, the SPU can detect and protect against various network attacks.
Network attacks are classified into three types: DoS attacks, scanning and snooping attacks, and
malformed packet attacks.
l
l
Issue 01 (2012-03-15)
shows an application of the firewall. The IP address-based statistics function is
Ethernet
Internal
network
DoS attack
Denial of service (DoS) attack attacks a system with a large number of data packets. This
prevents the system from receiving requests from authorized users or suspends the host.
DoS attacks include SYN Flood attack and Fraggle attack. DoS attacks are different from
other attacks because DoS attackers do not search for the ingress of a network but prevent
authorized users from accessing resources or routers.
Scanning and snooping attack
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
Switch
TCP
connection
Web server
129.9.0.1
2 Firewall Configuration
31
Advertisement
Table of Contents
