Configuring An Attack Defense Policy; Creating An Attack Defense Policy; Configuring A Single-Packet Attack Defense Policy - HPE Moonshot 45Gc Security Configuration Manual

Configuring an attack defense policy

Creating an attack defense policy

An attack defense policy can contain a set of attack detection and prevention configuration against
multiple attacks.
To create an attack defense policy:
Step
1. Enter system view.
2. Create an attack defense
policy and enter its view.

Configuring a single-packet attack defense policy

Single-packet attack detection inspects packets destined for the device based on the packet
signature. If an attack packet is detected, the device can take the following actions:
•
Output logs (the default action).
•
Drop attack packets.
You can also configure the device to not take any actions.
To configure a single-packet attack defense policy:
Step
1. Enter system view.
2. Enter attack
defense policy view.
3. Configure signature
detection for
single-packet
attacks.
Command
system-view
attack-defense policy
policy-name
Command
system-view
attack-defense policy policy-name
•
signature detect { fraggle | fragment |
impossible | ip-option-abnormal | land |
large-icmp | large-icmpv6 | ping-of-death |
smurf | snork | tcp-all-flags | tcp-fin-only |
tcp-invalid-flags | tcp-null-flag | tcp-syn-fin |
teardrop | tiny-fragment | traceroute |
udp-bomb | winnuke } [ action { { drop |
logging } * | none } ]
•
signature detect icmp-type { icmp-type-value |
address-mask-reply | address-mask-request
| destination-unreachable | echo-reply |
echo-request | information-reply |
information-request | parameter-problem |
redirect | source-quench | time-exceeded |
timestamp-reply | timestamp-request }
[ action { { drop | logging } * | none } ]
•
signature detect icmpv6-type
{ icmpv6-type-value | destination-unreachable
| echo-reply | echo-request | group-query |
group-reduction | group-report |
packet-too-big | parameter-problem |
time-exceeded } [ action { { drop | logging } * |
none } ]
•
signature detect ip-option { option-code |
internet-timestamp | loose-source-routing |
456
Remarks
N/A
By default, no attack defense policy
exists.
Remarks
N/A
N/A
By default, signature
detection is not
configured for
single-packet attacks.
You can configure
signature detection for
multiple single-packet
attacks.