HP VPN Firewall Appliances Attack Protection Configuration Guide

# Enable the blacklist function.

<Firewall> system-view

[Firewall] blacklist enable

# Add Host D's IP address 5.5.5.5 to the blacklist without configuring an aging time for it.

[Firewall] blacklist ip 5.5.5.5

# Add Host C's IP address 192.168.1.4 to the blacklist and configure the aging time as 50 minutes.

[Firewall] blacklist ip 192.168.1.4 timeout 50

Verifying the configuration

Use the display blacklist all command to display the added blacklist entries.

[Firewall] display blacklist all

Blacklist information

-------------------------------------------------------------------------

Blacklist : enabled

Blacklist items : 2

------------------------------------------------------------------------------

IP Type Aging started Aging finished Dropped packets

YYYY/MM/DD hh:mm:ss YYYY/MM/DD hh:mm:ss

5.5.5.5 manual 2008/04/09 16:02:20 Never 0

192.168.1.4 manual 2008/04/09 16:02:26 2008/04/09 16:52:26 0

After the configuration takes effect, Firewall should:

• Always drop packets from Host D unless you delete Host D's IP address from the blacklist by using

the undo blacklist ip 5.5.5.5 command.

• Within 50 minutes, drop Host C's packets received.

• After 50 minutes, correctly forward Host C's packets received.

Traffic statistics configuration example

Network requirements

As shown in Figure 43, configure traffic statistics in security zone Trust, and configure UDP flood attack

protection to protect the internal server against UDP flood attacks.

Figure 43 Network diagram