HPE Moonshot 45Gc Security Configuration Manual page 474

Step
Configuring a UDP flood attack defense policy
Step
1. Enter system view.
2. Enter attack defense policy
view.
3. Enable global UDP flood
attack detection.
4. Set the global trigger
threshold for UDP flood
attack prevention.
5. Specify global actions
against UDP flood attacks.
6. Configure IP
address-specific UDP flood
attack detection.
Configuring a DNS flood attack defense policy
Step
1. Enter system view.
2. Enter attack defense policy
view.
3. Enable global DNS flood
attack detection.
4. Set the global trigger
threshold for DNS flood
attack prevention.
5. (Optional.) Specify the
global ports to be protected
against DNS flood attacks.
6. Specify global actions
against DNS flood attacks.
7. Configure IP
address-specific DNS flood
attack detection.
Command
threshold-value ] [ action { drop |
logging } * ]
Command
system-view
attack-defense policy
policy-name
udp-flood detect non-specific
udp-flood threshold
threshold-value
udp-flood action { drop |
logging } *
udp-flood detect { ip ip-address
| ipv6 ipv6-address }
[ vpn-instance
vpn-instance-name ] [ threshold
threshold-value ] [ action { drop |
logging } * ]
Command
system-view
attack-defense policy
policy-name
dns-flood detect non-specific
dns-flood threshold
threshold-value
dns-flood port port-list
dns-flood action { drop |
logging } *
dns-flood detect { ip ip-address |
ipv6 ipv6-address }
[ vpn-instance
vpn-instance-name ] [ port
port-list ] [ threshold
threshold-value ] [ action { drop |
logging } * ]
461
Remarks
Remarks
N/A
N/A
By default, global UDP flood attack
detection is disabled.
The default setting is 1000.
By default, no global action is
specified for UDP flood attacks.
By default, IP address-specific UDP
flood attack detection is not
configured.
Remarks
N/A
N/A
By default, global DNS flood attack
detection is disabled.
The default setting is 1000.
By default, DNS flood attack
prevention protects port 53.
By default, no global action is
specified for DNS flood attacks.
By default, IP address-specific DNS
flood attack detection is not
configured.