Deploying a DecoySensor

Context

A DecoySensor identifies scanning behavior on an intranet, and lures suspicious traffic to a Decoy. The Decoy provides in-depth interaction services to further determine whether suspicious traffic is an attack.

Procedure

Run system-view
The system view is displayed.
Run deception
The deception view is created and displayed.
Run deception decoy destination destination-ip [ source source-ip ] [ vpn-instance vpn-instance-name ] [ backup destination destination-ip [ source source-ip ] [ vpn-instance vpn-instance-name ] ]
An IP address is configured for the Decoy.
Configure a detected network segment and a bait network segment, or at least one of them (otherwise, the deception function does not take effect).
1. Run deception detect-network id id-number ip-address mask [ vpn-instance vpn-instance-name ]
  A detected network segment is configured.
  
  By default, no detected network segment is configured on the switch.
2. Run deception decoy-network id id-number destination ip-address [ mask ] [ destination-port port &<1-20> ] [ vpn-instance vpn-instance-name ]
  A bait network segment is configured.
  
  By default, no bait network segment is configured on the switch.
(Optional) Run deception mode strict
The strict deception mode is enabled.

By default, the strict deception mode is disabled.
(Optional) Run deception arp-request rate rate-number
The IP address scanning threshold is configured.

By default, the IP address scanning threshold is 10 times per 10 seconds.
(Optional) Run deception syn-connect rate rate-number
The TCP port scanning threshold is configured.

By default, the TCP port scanning threshold is 100 times per second.
(Optional) Run deception whitelist id id-number { destination | source } ip-address [ mask ] [ vpn-instance vpn-instance-name ]
The deception whitelist is configured.

By default, no deception whitelist is configured on the switch.
(Optional) Run deception ip-state detect rate rate-number
The frequency of scanning IP addresses by the switch is configured.

By default, the switch scans IP addresses 30 times per second.
(Optional) Run deception mac-address aging-time aging-time
The interval at which the switch sends an ARP broadcast packet is configured.

By default, the switch sends an ARP broadcast packet at an interval of 290 seconds.
(Optional) Run deception dns-request rate rate-number
The domain name scan threshold is configured.

By default, the domain name scan threshold is 5 scans per second.
(Optional) Run deception dns enable
The unknown-domain-name deception function is enabled.

By default, the unknown-domain-name deception function is disabled.
(Optional) Run deception aci suffix
An ACI suffix is configured.

By default, the ACI suffix is aci.
(Optional) Run deception aci timeout timeout-value
The aging time of ACI entries is configured.

By default, the aging time of ACI entries is 60s. When a new DNS reply packet arrives, the corresponding ACI entry is updated.
(Optional) Run deception aci lack decoy
The policy used in the case of a full ACI table to deceive is configured.

By default, the policy used in the case of a full ACI table is permit.
(Optional) Run deception aci detect-network { id id-number | all } enable
The Access Control Isolation (ACI) deception function is enabled.

By default, the ACI deception function is disabled.
Run deception enable
The deception function is enabled.

By default, the deception function is disabled.

Verifying the Configuration

Run the display deception version command in any view to check the DecoySensor version.
Run the display deception decoy status command in any view to check the registration status of the switch on the Decoy.
Run the display deception detect-network [ id id-number ] command in any view to check the detected network segment.
Run the display deception decoy-network [ id id-number ] command in any view to check the bait network segment.
Run the display deception whitelist [ id id-number ] command in any view to check the deception whitelist.
Run the display deception interface command in any view to check information about all deception-enabled interfaces.
Run the display deception dns command in any view to check the domain name scan status.
Run the display deception aci command in any view to check the ACI table.