nat flow-defend reverse-blacklist detect-threshold

Usage Scenario

If no internal server is configured or if no session table entries can be found on the NAT device for public network traffic, the NAT device considers public network-to-private network traffic reaching a specified rate threshold as attack traffic. The NAT device sends such traffic to a NAT blacklist. The reverse first-packet blacklist prevents public-to-private first packets that trigger the creation of a session table from attacking a specific public IP address, public port number, protocol ID. Such attacks adversely affect the forwarding of normal traffic. To monitor the rate at which network attack traffics matching IP addresses in a NAT blacklist, run the nat flow-defend reverse-blacklist detect-threshold ip-level high-threshold command to set an IP address-level rate threshold. To monitor the rate at which network attack traffics matching an IP address, port number, or protocol ID in a NAT blacklist, run the nat flow-defend reverse-blacklist detect-threshold ip-port-level

high-threshold command to set a port-level rate threshold.Ensure that the configured threshold does not exceed the CPU processing capability. Otherwise, attack traffic cannot be blacklisted.

Precautions

In VS mode, this command is supported only by the admin VS.