application-apperceive default-action

Function

The application-apperceive default-action command sets a default action to be taken on the protocol packets to be sent to the CPU when the upper-layer protocols supporting application layer association are disabled.

By default, the default action taken by the application layer association module on the packets to be sent to the CPU is min-to-cp.

Format

application-apperceive default-action { drop | min-to-cp }

Parameters

Parameter	Description	Value
drop	Drops the packets to be sent to the CPU.	-
min-to-cp	Sends packets to the CPU at the lowest rate set on the device.	Sends packets to the CPU at 100 kbps (the lowest rate set on the device).

Parameter

Description

Value

drop

Drops the packets to be sent to the CPU.

min-to-cp

Sends packets to the CPU at the lowest rate set on the device.

Sends packets to the CPU at 100 kbps (the lowest rate set on the device).

Views

Attack defense policy view

Default Level

2: Configuration level

Task Name and Operations

Task Name	Operations
device-mgr	write

Usage Guidelines

Usage Scenario

The application-apperceive default-action command sets the default action to be taken on the protocol packets to be sent to the CPU when the upper-layer protocols supporting application layer association are disabled.

When application layer association and protocols are enabled, packets are sent to the CPU at the configured bandwidth; when application layer association is enabled but protocols are disabled, packets are sent to the CPU at the lowest rate or directly dropped.

When application layer association is disabled, packets are sent to the CPU according to the configured bandwidth regardless of whether the protocols are enabled.

The parameter min-to-cp parameter is recommended because it can help you to trace the attack source and collect attack information if a device is attacked when a protocol supporting the application layer association is disabled. If you specify only drop in the application-apperceive default-action command, the possibility of attack can be reduced, but the attack source cannot be traced. You can choose a proper parameter as required.

Prerequisites

The application-apperceive default-action command can take effect only when application layer association is enabled.

In VS mode, this command is supported only by the admin VS.

Example

# Configure the default action taken by the application layer association module on the packets to be sent to the CPU to drop in attack defense policy 6.

<HUAWEI> system-view
[~HUAWEI] cpu-defend policy 6
[*HUAWEI-cpu-defend-policy-6] application-apperceive default-action drop