deception decoy-network

Function

The deception decoy-network command configures a bait network segment.

The undo deception decoy-network command deletes a bait network segment.

By default, no bait network segment is configured on the switch.

Format

deception decoy-network id id-number destination ip-address [ mask ] [ destination-port port &<1-20> ] [ vpn-instance vpn-instance-name ]

undo deception decoy-network { all | id id-number }

Parameters

Parameter	Description	Value
id id-number	Specifies the ID of a bait network segment.	The value is an integer in the range from 1 to 50.
destination ip-address [ mask ]	ip-address specifies an IP address. mask specifies the subnet mask of the bait network segment.	The value is in dotted decimal notation.
destination-port port	Specifies the destination TCP port number. NOTE: If this parameter is specified, traffic will be lured immediately if this TCP port is scanned or the IP address corresponding to the TCP port is scanned.	The value is an integer in the range from 1 to 65535.
vpn-instance vpn-instance-name	Specifies the VPN instance for the bait network segment.	The VPN instance must be an existing one on the device.
all	Specifies all bait network segments.	-

Views

Deception view

Default Level

2: Configuration level

Usage Guidelines

Usage Scenario

After a bait network segment is configured, the switch does not detect whether the IP addresses on the bait network segment are online. If an IP address or TCP port on the bait network segment is scanned, the switch lures the scanning traffic to the Decoy for further attack detection. Therefore, you can add some idle IP addresses to the bait network segment.

Precautions

A deception whitelist configured using the deception whitelist command takes precedence over a bait network segment:

If an IP address is in both the deception destination IP address whitelist and the bait network segment, the switch ignores IP address scanning and TCP port scanning on the IP address and does not lure the traffic destined for the IP address.
If scanning is initiated by a whitelisted address and the scanned IP address is on the bait network segment, the switch does not lure the traffic.

A bait network segment cannot contain the device management address and any network segment (0.0.0.0). Otherwise, the devices cannot be managed remotely.

Example

# Add 10.1.1.11 to the bait network segment.

<HUAWEI> system-view
[HUAWEI] deception
[HUAWEI-deception] deception decoy-network id 1 destination 10.1.1.11