Applying An Attack Defense Policy To The Device; Enabling Log Non-Aggregation For Single-Packet Attack Events - HP FlexNetwork 10500 Series Security Configuration Manual

If you apply an attack defense policy to a global interface, specify a service card to process traffic for
the interface. If you do not specify a service card, the policy cannot correctly detect and prevent
scanning and flood attacks.
To apply an attack defense policy to an interface:
Step
1. Enter system view.
2. Enter system view.
3. Apply an attack defense
policy to the interface.
4. Specify a service card to
process traffic for the
interface.

Applying an attack defense policy to the device

An attack defense policy applied to the device itself rather than the interfaces detects packets
destined for the device and prevents attacks targeted at the device.
A switch uses hardware to implement packet forwarding and uses software to process packets if the
packets are destined for the switch. The software does not provide any attack defense features, so
you can apply an attack defense policy to the switch to prevent attacks aimed at the switch.
Applying an attack defense policy to a device can improve the efficiency of processing attack
packets destined for the device.
If a device and its interfaces have attack defense policies applied, a packet destined for the device is
processed as follows:
1. The policy applied to the receiving interface processes the packet.
2. If the packet is not dropped by the receiving interface, the policy applied to the device
processes the packet.
To apply an attack defense policy to the device:
Step
1. Enter system view.
2. Apply an attack defense
policy to the device.

Enabling log non-aggregation for single-packet attack events

Log aggregation aggregates all logs generated in a period and sends one log. The logs with the
same attributes for the following items can be aggregated:
•
Interface where the attack is detected.
•
Attack type.
•
Attack defense action.
•
Source and destination IP addresses.
•
VPN instance to which the victim IP address belongs.
Command
system-view
interface interface-type
interface-number
attack-defense apply policy
policy-name
service slot slot-number
Command
system-view
attack-defense local apply
policy policy-name
480
Remarks
N/A
N/A
By default, no attack defense policy
is applied to the interface.
Optional.
By default, no service card is
specified for the interface.
Remarks
N/A
By default, no attack defense policy
is applied to the device.