Attack Detection And Prevention Configuration Example; Network Requirements; Configuration Procedure - HPE Moonshot 45Gc Security Configuration Manual

Task
Clear flood attack detection and prevention
statistics.
Attack detection and prevention configuration
example

Network requirements

Configure attack detection and prevention on the switch (the gateway) to protect against network
attacks from the user side or the network side.
•
To prevent TCP flag attacks and low level scanning attacks that aim at the switch, enable TCP
flag attack prevention and scanning attack prevention. Configure the device to output logs if it
detects such attacks.
•
To prevent the SYN flood attacks that aim at the external interface of the switch, enable IP
address-specific SYN flood attack detection for 192.168.2.1/24. When the device receives 5000
or more SYN packets sent to the protected IP address per second, it outputs logs and drops the
packets.
•
To prevent the SYN flood attacks that aim at the internal interface of the switch, enable global
SYN flood attack detection. When the device receives 2000 or more SYN packets that are
destined to the switch but not to the protected IP address per second, it outputs logs.
Figure 138 Network diagram

Configuration procedure

# Create an attack defense policy named a1.
[Switch] attack-defense policy a1
# Enable signature detection for TCP single packet attacks and enable logging for the specified
attacks. A TCP packet is identified as an attack packet if it has all flags set, FIN flag set, invalid flags,
no TCP flags set, or both SYN and FIN flags set.
[Switch-attack-defense-policy-a1] signature detect tcp-all-flags action logging
[Switch-attack-defense-policy-a1] signature detect tcp-fin-only action logging
[Switch-attack-defense-policy-a1] signature detect tcp-invalid-flags action logging
[Switch-attack-defense-policy-a1] signature detect tcp-null-flag action logging
[Switch-attack-defense-policy-a1] signature detect tcp-syn-fin action logging
# Configure low level scanning attack detection and enables logging for such attack events.
[Router-attack-defense-policy-a1] scan detect level low action logging
Command
reset attack-defense policy policy-name flood
protected { ip | ipv6 } statistics
465