Configuring A Scanning Attack Defense Policy; Configuring A Flood Attack Defense Policy - HP FlexNetwork 10500 Series Security Configuration Manual

Step
5. (Optional.) Specify the
actions against
single-packet attacks of a
specific level.
6. (Optional.) Enable
signature detection for
single-packet attacks of a
specific level.

Configuring a scanning attack defense policy

Apply a scanning attack defense policy to the interface that is connected to the external network.
Scanning attack detection inspects the incoming packet rate of connections to the target system. If a
source initiates connections at a rate equal to or exceeding the pre-defined threshold, the device can
take the following actions:
•
Output logs.
•
Drop subsequent packets from the IP address of the attacker.
•
Add the attacker's IP address to the IP blacklist.
To blacklist the attackers, you must enable the blacklist feature globally or on the interface where the
defense policy is applied. For more information about the blacklist, see
feature."
To configure a scanning attack defense policy:
Step
1. Enter system view.
2. Enter attack defense policy
view.
3. Configure scanning attack
detection.

Configuring a flood attack defense policy

Apply a flood attack defense policy to the interface that is connected to the external network to
protect internal servers.
Flood attack detection monitors the rate at which connections are initiated to the internal servers.
With flood attack detection enabled, the device is in attack detection state. When the packet sending
rate to an IP address reaches the threshold, the device enters prevention state and takes the
specified actions. When the rate is below the silence threshold (three-fourths of the threshold), the
device returns to the attack detection state.
If a device has multiple service cards, the global trigger threshold you set takes effect on each
service card. The global trigger threshold of the device is the product of multiplying the value you set
by the service card quantity.
Command
signature level { high | info | low |
medium } action { { drop | logging } * |
none }
signature level { high | info | low |
medium } detect
Command
system-view
attack-defense policy
policy-name
scan detect level { high | low |
medium } action
{ { block-source [ timeout
minutes ] | drop } | logging } *
474
Remarks
The default action is logging
for single-packet attacks of the
informational and low levels.
The default actions are
logging and drop for
single-packet attacks of the
medium and high levels.
By default, signature detection
is disabled for all levels of
single-packet attacks.
"Configuring the IP blacklist
Remarks
N/A
N/A
By default, scanning attack
detection is not configured.