Huawei AR1200-S User Manual

By default, no attack defense function is enabled.
----End
3.10.3 Setting the Parameters for Flood Attack Defense
Context
Steps 2-4 are optional and can be performed in any sequence. You can select these steps to defend
different types of Flood attacks.
Procedure
Step 1 Run:
system-view
The system view is displayed.
Step 2 Run:
firewall defend icmp-flood { ip ip-address [ vpn-instance vpn-instance-name ] |
zone zone-name } [ max-rate rate-value ]
The parameters for ICMP Flood attack defense are set.
Step 3 Run:
firewall defend syn-flood { ip ip-address [ vpn-instance vpn-instance-name ] |
zone zone-name } [ max-rate rate-value ] | [ tcp-proxy { auto | off | on } ]
The parameters for SYN Flood attack defense are set.
Step 4 Run:
firewall defend udp-flood { ip ip-address [ vpn-instance vpn-instance-name ] |
zone zone-name } [ max-rate rate-value ]
The parameters for UDP Flood attack defense are set.
To prevent Flood attacks, you need to specify the zones or IP addresses to be protected;
otherwise, the attack defense parameters are invalid. You can also specify the maximum session
rate. When the session rate exceeds the limit, the AR1200-S considers that an attack occurs and
takes measures.
For Flood attack defense, the priority of IP addresses is higher than the priority of zones. If Flood
attack defense is enabled for both a specified IP address and the zone where the IP address
resides, then the attack defense for the IP address takes effect. If you cancel the attack defense
for the IP address, the attack defense for the zone takes effect.
By default, the maximum session rate for Flood attacks is 1000 pps, and the TCP proxy is enabled
for the SYN Flood attack defense.
For Flood attack defense, you can specify up to 32 IP addresses to protect.
----End
3.10.4 Configuring Large ICMP Packet Attack Defense
Huawei AR1200-S Series Enterprise Routers
Configuration Guide - Security 3 Firewall Configuration
Issue 02 (2012-03-30) Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
70

Huawei AR1200-S Specifications

General

Brand	Huawei
Model	AR1200-S
Category	Network Router
Language	English