Configuring Tcp Fragment Attack Prevention; Configuring The Ip Blacklist Feature - HP FlexNetwork 10500 Series Security Configuration Manual

As a best practice, do not disable log aggregation. A large number of logs will consume the display
resources of the console.
To enable log non-aggregation for single-packet attack events:
Step
1. Enter system view.
2. Enable log
non-aggregation for
single-packet attack
events.

Configuring TCP fragment attack prevention

The TCP fragment attack prevention feature detects the length and fragment offset of received TCP
fragments and drops attack TCP fragments.
TCP fragment attack prevention takes precedence over single-packet attack prevention. When both
are used, incoming TCP packets are processed first by TCP fragment attack prevention and then by
the single-packet attack defense policy.
To configure TCP fragment attack prevention:
Step
1. Enter system view.
2. Enable TCP fragment attack
prevention.

Configuring the IP blacklist feature

The IP blacklist feature filters packets sourced from IP addresses in blacklist entries.
IP blacklist entries can be manually added or dynamically learned:
•
You can manually add an IP blacklist entry by using the blacklist ip or blacklist ipv6 command.
These entries do not age out by default. You can set an aging time for each entry.
•
The device can automatically add IP blacklist entries when collaborating with scanning attack
detection. Each dynamically learned IP blacklist entry has an aging time, which is user
configurable. Make sure the block-source keyword is specified as the scanning attack
prevention action. For more information about the scanning attack detection and prevention,
see "Configuring a scanning attack defense
To configure the IP blacklist feature:
Step
1. Enter system view.
2. (Optional.) Enable the
global blacklist feature.
Command
system-view
attack-defense signature log
non-aggregate
Command
system-view
attack-defense tcp fragment
enable
policy."
Command
system-view
blacklist global enable
481
Remarks
N/A
By default, log non-aggregation is
disabled for single-packet attack
events.
Remarks
N/A
By default, TCP fragment attack
prevention is enabled.
TCP fragment attack prevention is
typically used alone.
Remarks
N/A
By default, the global blacklist
feature is disabled.
If the global blacklist feature is
enabled, the blacklist feature is
enabled on all interfaces.