Maipu Administration Guide

Configure Anti-DDOS Attack Detection

Network Requirements

Device is connected to IP Network via port gigabitethernet0/1.
Device configures the anti-DDOS attack detection function. When finding the attack packet, alarm and drop the attack packet, taking the common SYN Flood attack, Ping Flood attack, and Land attack as example.

Network Topology

Networking of configuring the anti-DDOS attack detection

Figure 17-1 Networking of configuring the anti-DDOS attack detection

Configuration Steps

Step 1: Configure VLAN and add the port to the corresponding VLAN. (Omitted)

Step 2: Configure the IP address of the interface. (Omitted)

Step 3: Configure the ACL rule.

#Configure the standard ACL rule, matching the Device address to be protected.

Device#configure terminal
Device(config)#ip access-list standard 1
Device(config-std-nacl)#permit host 100.0.0.1
Device(config-std-nacl)#exit

Step 4: Configure the attack detection function and enable the log recording function.

#Configure the SYN Flood, Ping Flood, and Land attack detection function on Device.

Device(config)# anti-attack detect tcp-land
Device(config)# anti-attack flood icmp list 1 maxcount 100
Device(config)# anti-attack flood tcp list 1 maxcount 100

#Enable the anti-DDOS attack detection log recording function on Device.

Device(config)#anti-attack log

Step 5: Check the result.

#When Device gets the SYN Flood attack, output the following log information:

%FW FLOOD_WARN-4: vlan2 gigabitethernet0/1 SYN flood attack detected, destination IP 100.0.0.1, 1000 packets/second.

#When Device gets the Ping Flood attack, output the following log information:

%FW-FLOOD_WARN-4: vlan2 gigabitethernet0/1 ICMP flood attack detected, destination IP 104.1.1.1, overflow 20 packets/second.

#When Device gets the Land attack, output the following log information:

%FW-LAND_WARN-4: LAND attack detected at vlan2 gigabitethernet0/1, source IP equals destination IP 100.0.0.1, source port equals destination port 1024.

#View the attack detection packet statistics information on Device:

IP attack        Drops  
-------------    ------    
Small IP         0
Fragment         0
Tcp-land         6256
Fraggle          0
SYN Flood        6200
ICMP Flood       4893

The DDOS attack detection function is valid only for the packets processed by CPU.