R0106-HP MSR Router Series Security Command Reference(V7)

612
Parameters
client-verify: Adds the victim IP addresses to the protected IP list for DNS client verification. If DNS client
verification is enabled, the device provides proxy services for protected servers.
drop: Drops subsequent DNS packets destined for the victim IP addresses.
logging: Enables logging for DNS flood attack events. The log information records the detection
interface, victim IP address, MPLS L3VPN instance name, current packet statistics, prevention actions,
and start time of the attack.
Usage guidelines
To configure the DNS flood attack detection to collaborate with the DNS client verification, make sure the
client-verify keyword is specified and the DNS client verification is enabled. To enable DNS client
verification, use the client-verify dns enable command.
Examples
# Specify drop as the global action against DNS flood attacks in attack defense policy atk-policy-1.
<Sysname> system-view
[Sysname] attack-defense policy atk-policy-1
[Sysname-attack-defense-policy-atk-policy-1] dns-flood action drop
Related commands
• dns-flood detect
• dns-flood detect non-specific
• dns-flood threshold
• client-verify dns enable
dns-flood detect
Use dns-flood detect to configure IP-specific DNS flood attack detection.
Use undo dns-flood detect to remove the DNS flood attack detection configuration for an IP address.
Syntax
dns-flood detect { ip ip-address | ipv6 ipv6-address } [ vpn-instance vpn-instance-name ] [ port port-list ]
[ threshold threshold-value ] [ action { client-verify | drop | logging } * ]
undo dns-flood detect { ip ip-address | ipv6 ipv6-address } [ vpn-instance vpn-instance-name ]
Default
DNS flood attack detection is not configured for any IP address.
Views
Attack defense policy view
Predefined user roles
network-admin
Parameters
ip ip-address: Specifies the IPv4 address to be protected. The ip-address argument cannot be all 1s or 0s.
ipv6 ipv6-address: Specifies the IPv6 address to be protected. The ipv6-address argument cannot be a
multicast address or all 0s.