R2511-HP MSR Router Series Security Configuration Guide(V5)

424
• ICMP session establishment rate
• Number of RAW IP sessions
• RAW IP session establishment rate
The device collects statistics to calculate the session establishment rates at an interval of 5 seconds.
Therefore, the session establishment rates displayed on the device are based on the statistics collected
during the latest 5-second interval.
The traffic statistics function does not concern about the session status (except the TCP half-open and
half-close states). As long as a session is established, the count increases by 1. As long as a session is
deleted, the count decreases by 1.
Attack detection and protection configuration task
list
The attack detection and protection configuration tasks include three categories:
• Configuring attack protection functions for an interface. To do so, you need to create an attack
protection policy, configure the required attack protection functions (such as Smurf attack protection,
scanning attack protection, and flood attack protection) in the policy, and then apply the policy to
the interface. There is no specific configuration order for the attack functions, and you can configure
them as needed.
• Configuring the blacklist function. This function can be used independently or used in conjunction
with the scanning attack protection function on an interface.
• Enabling the traffic statistics function. This function can be used independently.
Complete the following tasks to configure attack detection and protection:
Task Remarks
Configuring attack
protection functions for
an interface
Creating an attack protection policy Required.
Configuring an attack protection policy:
• Configuring a single-packet attack protection policy
• Configuring a scanning attack protection policy
• Configuring a flood attack protection policy
Required.
Configure one or
more policies as
needed.
Applying an attack protection policy to an interface Required.
Configuring the blacklist function Optional.
Enabling traffic statistics on an interface Optional.