CP-CAR Configuration Example

Networking Requirements

Security requirements for routers are as follows:

• Save system resources by preventing excessive usage of CPU resources.
• Prevent attackers from manipulating managed devices using management packets.
• Record attack packet information for fault analysis and location.
• Notify users of dropped packets by reporting an alarm.

Configuration Roadmap

The roadmap for configuring attack defense on the router is as follows:

• Identify and group the protocols used by various services on the router and differentiate normal service traffic from malicious traffic.
• Configure a CPU defense policy to specify the match sequence of traffic sent to the CPU.
  1. Configure TCP/IP attack defense check to prevent TCP/IP attacks.
  2. Configure the application layer association check to enable the router to check the bandwidth of received packets.
  3. Configure a processing policy for authorized packets. This policy enables the router to compare normal protocol packets and packets to be protected against the whitelist and user-defined flows. If matching the whitelist or user-defined flows, these packets will be sent to the CPU over different channels with different bandwidth based on priorities.
  4. Configure a processing policy for unauthorized packets and unknown packets. This policy enables the router to compare unauthorized packets and unknown packets against the blacklist. If matching the blacklist, these packets will be dropped or sent to the CPU over channels with limited bandwidth at a lower priority.
  5. Configure attack source tracing, so that dropped packets can be recorded for fault analysis and location.
  6. Enable the packet drop alarm function.
  

  By default, TCP SYN flood attack defense is enabled. TCP SYN flood attack defense takes precedence over the configured blacklist function. Therefore, the ACL specified for TCP SYN flood attack defense other than the ACL specified in the blacklist acl command is used to filter TCP SYN packets.

  Before using the ACL specified in the blacklist acl command to filter TCP SYN packets, run the undo tcpsyn-flood enable command to disable TCP SYN flood attack defense.

  If TCP SYN flood attack defense is disabled, the TCP SYN packets that fail to match the ACL specified in the blacklist acl command will be sent to the CPU. Therefore, exercise caution when running the undo tcpsyn-flood enable command.

• Configure management plane protection to prevent unauthorized users from launching attacks through non-management interfaces (management plane) using management packets.

Data Preparation

The data used in this example is for your reference only. For configuration data required for live networks, contact Huawei engineers.

Operation Procedure

1. Configure a CPU defense policy.

   <DeviceA> system-view 
   [~HUAWEI] sysname DeviceA
   [*HUAWEI] commit
   [~DeviceA] cpu-defend policy 10
   [*DeviceA-cpu-defend-policy-10] commit

2. Configure defense against TCP/IP packet attacks.

   [*DeviceA-cpu-defend-policy-10] fragment-flood enable
   [*DeviceA-cpu-defend-policy-10] udp-packet-defend enable
   [*DeviceA-cpu-defend-policy-10] abnormal-packet-defend enable
   [*DeviceA-cpu-defend-policy-10] commit

3. Set the match sequence of packets to be sent to the CPU.

   The match sequence of packets to be sent to the CPU is as follows: TCPSYN packets -> packet fragments -> dynamic link protection -> management protocol ACL -> whitelist -> user-defined flow -> blacklist.

   [~DeviceA-cpu-defend-policy-10] process-sequence tcpsyn-flood fragment-flood dynamic-link-protection management-acl whitelist user-defined-flow blacklist
   [*DeviceA-cpu-defend-policy-10] commit

4. Configure the match rules of a blacklist.

   [~DeviceA] acl number 3330
   [*DeviceA-acl-adv-3330] rule deny ip source 10.1.1.0 0.0.0.255
   [*DeviceA-acl-adv-3330] commit
   [~DeviceA-acl-adv-3330] quit

5. Configure the action of a blacklist.

   [~DeviceA-cpu-defend-policy-10] blacklist acl 3330
   [*DeviceA-cpu-defend-policy-10] car blacklist cir 0
   [*DeviceA-cpu-defend-policy-10] commit

6. Configure a user-defined flow.
   • Add the IP address of a trusted network segment to ACL 3330.

     <DeviceA> system-view 
     [~DeviceA] acl number 3331
     [*DeviceA-acl-adv-3331] rule permit ip source 10.1.2.0 0.0.0.255
     [*DeviceA-acl-adv-3331] rule permit ip source 10.1.3.0 0.0.0.255
     [*DeviceA-acl-adv-3331] commit
     [~DeviceA-acl-adv-3331] quit

   • Add BGP to ACL 3331.

     The device supports BGP dynamic link protection. BGP protocol packets for which BGP routes are established match the whitelist and sent to the CPU. This ACL limits the BGP peer protocol packets for which BGP routes are not established.

     [~DeviceA] acl number 3332
     [*DeviceA-acl-adv-3332] rule permit tcp destination-port eq bgp
     [*DeviceA-acl-adv-3332] commit

   • Use ACL 3332 to filter BGP packets.

     The device supports dynamic link protection for BGP protocol packets. The packets with session entries being set up can be forwarded preferentially. For the BGP peer protocol packets with session entries not being set up, you can also define an ACL to implement rate limit for these packets.

     [~DeviceA] acl number 3332
     [*DeviceA-acl-adv-3332] rule permit tcp source 10.12.1.0 0.0.0.255 destination-port eq bgp
     [*DeviceA-acl-adv-3332] rule permit tcp source 10.12.1.0 0.0.0.255 source-port eq bgp
     [*DeviceA-acl-adv-3332] commit

   • Add LDP to ACL 3333.
     

     The establishment of an LDP session is different from that of a BGP session. LDP establishes a connection using TCP but maintains the peer relationship using UDP. This process involves not only the peer address, but also the IP address of the directly connected interface. Perform the following steps to establish an LDP session:

     Run the display mpls ldp peer command to obtain peer information:

     [~DeviceA-acl-adv-3332] display mpls ldp peer 
              LDP Peer Information in Public network 
      ------------------------------------------------------------------------------ 
      Peer-ID                Transport-Address  Discovery-Source 
      ------------------------------------------------------------------------------ 
      1.1.1.32:0             1.1.1.32           GigabitEthernet0/1/28 
      ------------------------------------------------------------------------------ 
      TOTAL: 1 Peer(s) Found. 
     

     View the IP address of the interface directly connected to the local device.

     [*DeviceA-GigabitEthernet0/1/28]display this 
     # 
     interface GigabitEthernet0/1/28 
     undo shutdown 
     ip address 11.11.11.2 255.255.255.0 
     mpls 
     mpls ldp 
     #
     

     Local LDP discovers peers through bidirectional Hello packets. Hello packets are UDP packets with the source address being the local interface address and destination address being the multicast IP address. Remote LDP discovers peers similarly. The only difference is that the destination address is changed to the configured remote peer address. Add the peer's Hello packets to the ACL.

     [~DeviceA] acl number 3333
     [*DeviceA-acl-adv-3333] rule permit udp source 11.11.11.1 0 destination-port eq 646
     [*DeviceA-acl-adv-3333] rule permit udp source 11.11.11.1 0 source-port eq 646
     [*DeviceA-acl-adv-3333] commit

     The local LDP transport address is carried in the Hello packet payload. After using the LDP Hello packet to discover the peer and obtain the transport address of the peer, the device attempts to establish an LDP session using TCP to transmit notification messages. In TCP interaction, the device with a larger transport address initiates a TCP connection setup request, with the destination port number of 646 and a random source port number. You can skip this step and add two ACL rules.

     [*DeviceA-acl-adv-3333] rule permit tcp source 1.1.1.32 0 destination-port eq 646
     [*DeviceA-acl-adv-3333] rule permit tcp source 1.1.1.32 0 source-port eq 646
     [*DeviceA-acl-adv-3333] commit

     

     • If a device has multiple LDP peers, add four ACL rules for each peer address.
     • ACL rules can be configured based on the source IP address + port number or solely on the port number. ACL rules configured based on the source IP address + port number are more secure, but complicated in information collection. ACL rules configured based solely on the port number are less secure, but easy to configure. Choose either of the preceding methods as needed. A simplified configuration procedure is as follows:

     [~DeviceA-acl-adv-3332] acl number 3333 
     [*DeviceA-acl-adv-3333] rule permit tcp source-port eq 646 
     [*DeviceA-acl-adv-3333] rule permit tcp destination-port eq 646 
     [*DeviceA-acl-adv-3333] rule permit udp source-port eq 646 
     [*DeviceA-acl-adv-3333] rule permit udp destination-port eq 646
     [*DeviceA-acl-adv-3333] commit

   • Add OSPF and RIP to ACL 3334.

     [~DeviceA] acl number 3334

     

     The device supports OSPF dynamic link protection. OSPF protocol packets for which OSPF routes are established match the whitelist and sent to the CPU. This ACL limits the OSPF protocol packets for which OSPF routes are not established.

     [*DeviceA-acl-adv-3334] rule 5 permit ospf
     [*DeviceA-acl-adv-3334] commit

     Configuring ACL rules for RIP is similar to configuring ACL rules for OSPF.

   • Add VRRP to ACL 3335.
     

     VRRP is an IP-based protocol, and its protocol number is 112. VRRP sends packets based on the IP addresses of virtual interfaces on peers. The protocol number and IP addresses of virtual interfaces need to be added to the ACL for protection. VRRP peer information can be obtained using the display vrrp command.

     [~DeviceA] acl number 3335
     [*DeviceA-acl-adv-3335] rule permit 112 source 11.11.11.100 0
     [*DeviceA-acl-adv-3335] quit

     

     • If a device has multiple VRRP peers, define an ACL rule for each peer address.
     • ACL rules can be configured based on the source IP address + port number or solely on the port number. ACL rules configured based on the source IP address + port number are more secure, but complicated in information collection. ACL rules configured based solely on the port number are less secure, but easy to configure. Choose either of the preceding methods as needed. A simplified configuration procedure is as follows:

     [*DeviceA-acl-adv-3335] rule 5 permit 112
     [*DeviceA-acl-adv-3335] commit

   • Multicast protocols.
     

     PIM is a multicast protocol, and the port number is 103.

     [~DeviceA] acl number 3336
     [*DeviceA-acl-adv-3336] rule permit 103
     [*DeviceA-acl-adv-3336] quit
     [*DeviceA] acl number 3337
     [*DeviceA-acl-adv-3337] rule permit igmp
     [*DeviceA-acl-adv-3337] commit
     [*DeviceA-acl-adv-3337] quit
     [*DeviceA] acl number 3338
     [*DeviceA-acl-adv-3338] rule permit udp destination-port eq 639
     [*DeviceA-acl-adv-3338] rule permit udp source-port eq 639
     [*DeviceA-acl-adv-3338] rule permit tcp destination-port eq 639
     [*DeviceA-acl-adv-3338] rule permit tcp source-port eq 639
     [*DeviceA-acl-adv-3338] commit
     [~DeviceA-acl-adv-3338] quit

   • Add reserved multicast addresses from 224.0.0.0 to 224.0.0.255 to ACL 3399.

     [~DeviceA] acl number 3339
     [*DeviceA-acl-adv-3339] rule permit ip destination 224.0.0.0 0.0.0.255
     [*DeviceA-acl-adv-3339] commit
     [~DeviceA-acl-adv-3339] quit

   • Add reserved broadcast address 255.255.255.255 to ACL 3340.

     [~DeviceA] acl number 3340
     [*DeviceA-acl-adv-3340] rule permit ip destination 255.255.255.255 0
     [*DeviceA-acl-adv-3340] commit
     [~DeviceA-acl-adv-3340] quit

   • Add Telnet and SSH to ACL 3341.
     

     Telnet and SSH are TCP-based protocols. They are used for login and are very important protocols. Therefore, the two protocols are added to a separate ACL for protection. The device supports Telnet and SSH dynamic link protection. Telnet and SSH protocol packets for which Telnet and SSH links are established match the whitelist and sent to the CPU. This ACL limits the Telnet and SSH protocol packets for which Telnet and SSH links are not established. The SSH port number is 22. Configuring the device to drop management protocol packets with unknown source addresses is recommended.

     [~DeviceA] acl number 3341
     [*DeviceA-acl-adv-3341] rule permit tcp source 192.168.1.0 0.0.0.255 source-port eq telnet
     [*DeviceA-acl-adv-3341] rule permit tcp source 192.168.1.0 0.0.0.255 destination-port eq telnet
     [*DeviceA-acl-adv-3341] rule permit tcp source 192.168.1.0 0.0.0.255 source-port eq 22
     [*DeviceA-acl-adv-3341] rule permit tcp source 192.168.1.0 0.0.0.255 destination-port eq 22
     [*DeviceA-acl-adv-3341] quit
     [*DeviceA-acl-adv-3341] rule deny tcp destination-port eq telnet
     [*DeviceA-acl-adv-3341] rule deny tcp destination-port eq 22
     [*DeviceA-acl-adv-3341] commit

   • Add FTP and TFTP to ACL 3342.
     

     FTP is based on TCP whereas TFTP is based on UDP. Each source address requires three ACL rules.

     [~DeviceA] acl number 3342
     [*DeviceA-acl-adv-3342] rule permit udp source 192.168.1.0 0.0.0.255 destination-port eq tftp
     [*DeviceA-acl-adv-3342] rule permit tcp source 192.168.1.0 0.0.0.255 source-port eq ftp
     [*DeviceA-acl-adv-3342] rule permit tcp source 192.168.1.0 0.0.0.255 destination-port eq ftp
     [*DeviceA-acl-adv-3342] quit

     

     • The ranges of FTP and TFTP source address segments must be confirmed by carriers.
     • ACL rules can be configured based on the source IP address + port number or solely on the port number. ACL rules configured based on the source IP address + port number are more secure, but complicated in information collection. ACL rules configured based solely on the port number are less secure, but easy to configure. Choose either of the preceding methods as needed. A simplified configuration procedure is as follows:

     [*DeviceA-acl-adv-3342] rule permit udp destination-port eq tftp 
     [*DeviceA-acl-adv-3342] rule permit tcp source-port eq ftp 
     [*DeviceA-acl-adv-3342] rule permit tcp destination-port eq ftp
     [*DeviceA-acl-adv-3342] commit

   • Add SNMP to ACL 3343.
     

     A network management system (NMS) is deployed on most live networks. An NMS server sends a large number of UDP request packets, and devices send UDP reply packets through SNMP ports. As a large number of packets need to be exchanged, these devices need to be added to a separate ACL for protection.

     The source address segment added to the ACL must be confirmed by the customer. Otherwise, the NMS servers with IP addresses not being listed in the ACL will fail to manage the device. SNMP is a system management protocol. Configuring the device to drop SNMP protocol packets with unknown source addresses is recommended.

     [~DeviceA] acl number 3343
     [*DeviceA-acl-adv-3343] rule permit udp source 10.20.20.0 0.0.0.255 source-port eq snmp
     [*DeviceA-acl-adv-3343] rule permit udp source 10.20.20.0 0.0.0.255 destination-port eq snmp
     [*DeviceA-acl-adv-3343] rule deny udp destination-port eq snmp
     [*DeviceA-acl-adv-3343] commit

   • Add Tacacs to ACL 3344.
     

     Tacacs is a service protocol. Both the Tacacs protocols: TCP-based Huawei enhanced Tacacs and UDP-based standard Tacacs need to be added to the ACL 3344.

     [~DeviceA] acl number 3344
     [*DeviceA-acl-adv-3344] rule permit tcp source 5.5.5.5 0 source-port eq tacacs
     [*DeviceA-acl-adv-3344] rule permit tcp source 6.6.6.6 0 destination-port eq tacacs
     [*DeviceA-acl-adv-3344] rule permit udp source 5.5.5.5 0 source-port eq tacacs-ds
     [*DeviceA-acl-adv-3344] rule permit udp source 6.6.6.6 0 destination-port eq tacacs-ds
     [*DeviceA-acl-adv-3344] quit

     

     • The TACACS source address segment added to the ACL must be confirmed by carriers.
     • ACL rules can be configured based on the source IP address + port number or solely on the port number. ACL rules configured based on the source IP address + port number are more secure, but complicated in information collection. ACL rules configured based solely on the port number are less secure, but easy to configure. User can select the ACL rule configuration mode as required. You can configure ACL rules based solely on the port number as follows:

     acl number 3344 
      rule permit tcp source-port eq tacacs 
      rule permit tcp destination-port eq tacacs   
      rule permit udp source-port eq tacacs-ds 
      rule permit udp destination-port eq tacacs-ds 
     

   • Add NTP to ACL 3345.
     

     NTP is a service protocol, and the port number is 123.

     [~DeviceA] acl number 3345
     [*DeviceA-acl-adv-3345] rule permit udp source 172.16.0.0 0.0.255.255 source-port eq 123 
     [*DeviceA-acl-adv-3345] rule permit udp source 172.16.0.0 0.0.255.255 destination-port eq 123
     [*DeviceA-acl-adv-3345] commit
     [~DeviceA-acl-adv-3345] quit

     

     • The NTP source address segment added to the ACL must be confirmed by carriers.
     • ACL rules can be configured based on the source IP address + port number or solely on the port number. ACL rules configured based on the source IP address + port number are more secure, but complicated in information collection. ACL rules configured based solely on the port number are less secure, but easy to configure. User can select the configuration mode as required. You can configure ACL rules based solely on the port number as follows:

     acl number 3345 
      rule permit udp source- port eq 123 
      rule permit udp destination- port eq 123 
     

   • Add ICMP and Tracert to ACL 3346.

     [~DeviceA] acl number 3346
     [*DeviceA-acl-adv-3346] rule permit icmp icmp-type echo
     [*DeviceA-acl-adv-3346] rule permit icmp icmp-type echo-reply
     [*DeviceA-acl-adv-3346] rule permit icmp icmp-type ttl-exceeded
     [*DeviceA-acl-adv-3346] rule permit icmp icmp-type port-unreachable
     [*DeviceA-acl-adv-3346] rule permit icmp icmp-type Fragmentneed-DFset
     [*DeviceA-acl-adv-3346] rule permit icmp
     [*DeviceA-acl-adv-3346] rule permit udp destination-port range 33434 33678
     [*DeviceA-acl-adv-3346] quit

   • Add Ping-LSP to ACL 3347.

     [*DeviceA] acl number 3347
     [*DeviceA-acl-adv-3347] rule permit udp destination-port eq 3503
     [*DeviceA-acl-adv-3347] commit
     [~DeviceA-acl-adv-3347] quit

   • Add unknown protocols to ACL 3348.
     

     If unauthorized protocol packets and attack packets are limited by ACL 3330 to which the blacklist is bound, and authorized protocol packets and packets from the trusted network segments is limited by ACLs from 3331 to 3347, other protocol packets are considered as packets of unknown protocols and limited by ACL 3348. The corresponding user-defined flow configures a best-effort bandwidth for these packets of unknown protocols and sends them to the CPU with low priority.

     This configuration is optional. If no ACL is configured to filter packets of unknown protocols, these packets are sent to the CPU from the default channel. Ensure that the system can process authorized service and protocol packets based on the preceding configurations before you configure this ACL and corresponding user-defined flow for packets of unknown protocols.

     [~DeviceA] acl number 3348
     [*DeviceA-acl-adv-3348] rule permit udp
     [*DeviceA-acl-adv-3348] rule permit tcp
     [*DeviceA-acl-adv-3348] rule permit ip
     [*DeviceA-acl-adv-3348] commit
     [~DeviceA-acl-adv-3348] quit

7. Configure a user-defined flow.

   After classifying packets using an ACL, create user-defined flows to direct protocol packets to different channels.

   • Configure the action of user-defined flow 1.

     [*DeviceA-cpu-defend-policy-10] user-defined-flow 1 acl 3331
     [*DeviceA-cpu-defend-policy-10] car user-defined-flow 1 cir 1000
     [*DeviceA-cpu-defend-policy-10] priority user-defined-flow 1 high

   • Configure the action of user-defined flow 2.

     [*DeviceA-cpu-defend-policy-10] user-defined-flow 2 acl 3332
     [*DeviceA-cpu-defend-policy-10] car user-defined-flow 2 cir 512 cbs 1000000
     [*DeviceA-cpu-defend-policy-10] priority user-defined-flow 2 high
     [*DeviceA-cpu-defend-policy-10] alarm drop-rate user-defined-flow 2 enable
     [*DeviceA-cpu-defend-policy-10] alarm drop-rate user-defined-flow 2 threshold 100 interval 60

   • Configure the action of user-defined flow 3.

     [*DeviceA-cpu-defend-policy-10] user-defined-flow 3 acl 3333
     [*DeviceA-cpu-defend-policy-10] car user-defined-flow 3 cir 512 cbs 1000000
     [*DeviceA-cpu-defend-policy-10] priority user-defined-flow 3 high
     [*DeviceA-cpu-defend-policy-10] alarm drop-rate user-defined-flow 3 enable
     [*DeviceA-cpu-defend-policy-10] alarm drop-rate user-defined-flow 3 threshold 100 interval 60

     

     LDP is easy to flap. If more than three LDP packets get lost, LDP may go Down. The attack defense alarm function must be configured.

   • Configure the action of user-defined flow 4.

     [*DeviceA-cpu-defend-policy-10] user-defined-flow 4 acl 3334
     [*DeviceA-cpu-defend-policy-10] car user-defined-flow 4 cir 1000 cbs 1000000
     [*DeviceA-cpu-defend-policy-10] priority user-defined-flow 4 high
     [*DeviceA-cpu-defend-policy-10] alarm drop-rate user-defined-flow 4 enable
     [*DeviceA-cpu-defend-policy-10] alarm drop-rate user-defined-flow 4 threshold 100 interval 60

   • Configure the action of user-defined flow 5.

     [*DeviceA-cpu-defend-policy-10] user-defined-flow 5 acl 3335
     [*DeviceA-cpu-defend-policy-10] car user-defined-flow 5 cir 1300 cbs 1000000
     [*DeviceA-cpu-defend-policy-10] priority user-defined-flow 5 high

   • Configure the action of user-defined flow 6.

     [*DeviceA-cpu-defend-policy-10] user-defined-flow 6 acl 3336
     [*DeviceA-cpu-defend-policy-10] car user-defined-flow 6 cir 1000 cbs 1000000
     [*DeviceA-cpu-defend-policy-10] priority user-defined-flow 6 high

   • Configure the action of user-defined flow 7.

     [*DeviceA-cpu-defend-policy-10] user-defined-flow 7 acl 3337
     [*DeviceA-cpu-defend-policy-10] car user-defined-flow 7 cir 512 cbs 512000
     [*DeviceA-cpu-defend-policy-10] priority user-defined-flow 7 high

   • Configure the action of user-defined flow 8.

     [*DeviceA-cpu-defend-policy-10] user-defined-flow 8 acl 3338
     [*DeviceA-cpu-defend-policy-10] car user-defined-flow 8 cir 512 cbs 512000
     [*DeviceA-cpu-defend-policy-10] priority user-defined-flow 8 low

   • Configure the action of user-defined flow 9.

     [*DeviceA-cpu-defend-policy-10] user-defined-flow 9 acl 3339
     [*DeviceA-cpu-defend-policy-10] car user-defined-flow 9 cir 512 cbs 40000
     [*DeviceA-cpu-defend-policy-10] priority user-defined-flow 9 high

   • Configure the action of user-defined flow 10.

     [*DeviceA-cpu-defend-policy-10] user-defined-flow 10 acl 3339
     [*DeviceA-cpu-defend-policy-10] car user-defined-flow cir 512 cbs 20000
     [*DeviceA-cpu-defend-policy-10] priority user-defined-flow 10 low

   • Configure the action of user-defined flow 11.

     [*DeviceA-cpu-defend-policy-10] user-defined-flow 11 acl 3341
     [*DeviceA-cpu-defend-policy-10] car user-defined-flow 11 cir 512 cbs 300000
     [*DeviceA-cpu-defend-policy-10] priority user-defined-flow 11 middle

   • Configure the action of user-defined flow 12.

     [*DeviceA-cpu-defend-policy-10] user-defined-flow 12 acl 3342
     [*DeviceA-cpu-defend-policy-10] car user-defined-flow 12 cir 512 cbs 5120
     [*DeviceA-cpu-defend-policy-10] priority user-defined-flow 12 low

   • Configure the action of user-defined flow 13.

     [*DeviceA-cpu-defend-policy-10] user-defined-flow 13 acl 3343
     [*DeviceA-cpu-defend-policy-10] car user-defined-flow 13 cir 1000
     [*DeviceA-cpu-defend-policy-10] priority user-defined-flow 13 low

   • Configure the action of user-defined flow 14.

     [*DeviceA-cpu-defend-policy-10] user-defined-flow 14 acl 3344
     [*DeviceA-cpu-defend-policy-10] car user-defined-flow 14 cir 1000 cbs 1000000
     [*DeviceA-cpu-defend-policy-10] priority user-defined-flow 14 low

   • Configure the action of user-defined flow 15.

     [*DeviceA-cpu-defend-policy-10] user-defined-flow 15 acl 3345
     [*DeviceA-cpu-defend-policy-10] car user-defined-flow 15 cir 150 cbs 15000
     [*DeviceA-cpu-defend-policy-10] priority user-defined-flow 15 low

   • Configure the action of user-defined flow 16.

     [*DeviceA-cpu-defend-policy-10] user-defined-flow 16 acl 3346
     [*DeviceA-cpu-defend-policy-10] car user-defined-flow 16 cir 512 cbs 256000
     [*DeviceA-cpu-defend-policy-10] priority user-defined-flow 16 low

   • Configure the action of user-defined flow 17.

     [*DeviceA-cpu-defend-policy-10] user-defined-flow 17 acl 3347
     [*DeviceA-cpu-defend-policy-10] car user-defined-flow 17 cir 1000 cbs 40000 
     [*DeviceA-cpu-defend-policy-10] priority user-defined-flow 17 high

   • Configure the action of user-defined flow 18.

     [*DeviceA-cpu-defend-policy-10] user-defined-flow 18 acl 3348
     [*DeviceA-cpu-defend-policy-10] car user-defined-flow 18 cir 512 cbs 1000000
     [*DeviceA-cpu-defend-policy-10] priority user-defined-flow 18 low
     [*DeviceA-cpu-defend-policy-10] commit

8. Apply an attack defense policy.

   [~DeviceA] slot 1
   [~DeviceA-slot-1] cpu-defend-policy 10
   [*DeviceA-slot-1] commit
   [~DeviceA-slot-1] quit

9. Verify the configuration.

   Run the display cpu-defend policy policy-number command to check the ACL rules for filtering packets to be sent to the CPU.

   Run the display cpu-defend car { blacklist | index index | protocol | user-defined-flow flow-id | whitelist } statistics [ slot slot-id ] command to check statistics about packets dropped by the CAR function.

Configuration Files

#
 sysname DeviceA
#
cpu-defend policy 10
 blacklist acl 3330
 user-defined-flow 1 acl 3331
 user-defined-flow 2 acl 3332
 user-defined-flow 3 acl 3333
 user-defined-flow 4 acl 3334
 user-defined-flow 5 acl 3335
 user-defined-flow 6 acl 3336
 user-defined-flow 7 acl 3337
 user-defined-flow 8 acl 3338
 user-defined-flow 9 acl 3339
 user-defined-flow 10 acl 3340
 user-defined-flow 11 acl 3341
 user-defined-flow 12 acl 3342
 user-defined-flow 13 acl 3343
 user-defined-flow 14 acl 3344
 user-defined-flow 15 acl 3345
 user-defined-flow 16 acl 3346
 user-defined-flow 17 acl 3347
 user-defined-flow 18 acl 3348
 alarm drop-rate user-defined-flow 2 threshold 100 interval 60
 alarm drop-rate user-defined-flow 3 threshold 100 interval 60
 alarm drop-rate user-defined-flow 4 threshold 100 interval 60
 car blacklist cir 0
 car user-defined-flow 1 cir 1000
 car user-defined-flow 2 cir 512 cbs 1000000
 car user-defined-flow 3 cir 512 cbs 1000000
 car user-defined-flow 4 cir 1000 cbs 1000000
 car user-defined-flow 5 cir 1300 cbs 1000000
 car user-defined-flow 6 cir 1000 cbs 1000000
 car user-defined-flow 7 cir 512 cbs 512000
 car user-defined-flow 8 cir 512 cbs 5120
 car user-defined-flow 9 cir 512 cbs 40000
 car user-defined-flow 10 cir 512
 car user-defined-flow 11 cir 512 cbs 300000
 car user-defined-flow 12 cir 512 cbs 5120
 car user-defined-flow 13 cir 1000
 car user-defined-flow 14 cir 1000 cbs 1000000
 car user-defined-flow 15 cir 150 cbs 15000
 car user-defined-flow 16 cir 512 cbs 256000
 car user-defined-flow 17 cir 1000 cbs 40000
 car user-defined-flow 18 cir 512 cbs 1000000
 priority user-defined-flow 1 high
 priority user-defined-flow 2 high
 priority user-defined-flow 3 high
 priority user-defined-flow 4 high
 priority user-defined-flow 5 high
 priority user-defined-flow 6 high
 priority user-defined-flow 7 high
 priority user-defined-flow 8 low
 priority user-defined-flow 9 high
 priority user-defined-flow 10 low
 priority user-defined-flow 11 middle
 priority user-defined-flow 12 low
 priority user-defined-flow 13 low
 priority user-defined-flow 14 low
 priority user-defined-flow 15 low
 priority user-defined-flow 16 low
 priority user-defined-flow 17 high
 priority user-defined-flow 18 low
 process-sequence tcpsyn-flood fragment-flood dynamic-link-protection management-acl whitelist user-defined-flow blacklist
#
#
acl number 3330
 rule 5 deny ip source 10.1.1.0 0.0.0.255
#
acl number 3331
 rule 5 permit ip source 10.1.2.0 0.0.0.255
 rule 10 permit ip source 10.1.3.0 0.0.0.255
#
acl number 3332
 rule 5 permit tcp  source 10.12.1.0 0.0.0.255 destination-port eq bgp
 rule 10 permit tcp  source 10.12.1.0 0.0.0.255 source-port eq bgp

#
acl number 3333
 rule 5 permit udp source 11.11.11.1 0 destination-port eq 646
 rule 10 permit udp source 11.11.11.1 0 source-port eq 646
 rule 15 permit tcp source 1.1.1.32 0 destination-port eq 646
 rule 20 permit tcp source 1.1.1.32 0 source-port eq 646
#
acl number 3334
 rule 5 permit ospf
#
acl number 3335
 rule 5 permit 112 source 11.11.11.100 0
#
acl number 3336
 rule 5 permit 103
#
acl number 3337
 rule 5 permit igmp
#
acl number 3338
 rule 5 permit udp destination-port eq 639
 rule 10 permit udp source-port eq 639
 rule 15 permit tcp destination-port eq 639
 rule 20 permit tcp source-port eq 639
#
acl number 3339
 rule 5 permit ip destination 224.0.0.0 0.0.0.255
#
acl number 3340
 rule 5 permit ip destination 255.255.255.255 0
#
acl number 3341
 rule 5 permit tcp source 192.168.1.0 0.0.0.255 source-port eq telnet
 rule 10 permit tcp source 192.168.1.0 0.0.0.255 destination-port eq telnet
 rule 15 permit tcp source 192.168.1.0 0.0.0.255 source-port eq 22
 rule 20 permit tcp source 192.168.1.0 0.0.0.255 destination-port eq 22
 rule 100 deny tcp destination-port eq telnet
 rule 105 deny tcp destination-port eq 22
#
acl number 3342
 rule 5 permit udp source 192.168.1.0 0.0.0.255 destination-port eq tftp
 rule 10 permit tcp source 192.168.1.0 0.0.0.255 source-port eq ftp
 rule 15 permit tcp source 192.168.1.0 0.0.0.255 destination-port eq ftp
#
acl number 3343
 rule 5 permit udp source 10.20.20.0 0.0.0.255 source-port eq snmp
 rule 10 permit udp source 10.20.20.0 0.0.0.255 destination-port eq snmp
 rule 100 deny udp destination-port eq snmp
#
acl number 3344
 rule 5 permit tcp source 5.5.5.5 0 source-port eq tacacs
 rule 10 permit tcp source 6.6.6.6 0 destination-port eq tacacs
 rule 15 permit udp source 5.5.5.5 0 source-port eq tacacs-ds
 rule 20 permit udp source 6.6.6.6 0 destination-port eq tacacs-ds
#
acl number 3345
 rule 5 permit udp source 172.16.0.0 0.0.255.255 source-port eq ntp
 rule 10 permit udp source 172.16.0.0 0.0.255.255 destination-port eq ntp
#
acl number 3346
 rule 5 permit icmp icmp-type echo
 rule 10 permit icmp icmp-type echo-reply
 rule 15 permit icmp icmp-type ttl-exceeded
 rule 20 permit icmp icmp-type port-unreachable
 rule 25 permit icmp icmp-type fragmentneed-DFset
 rule 30 permit icmp
 rule 35 permit udp destination-port range 33434 33678
#
acl number 3347
 rule 5 permit udp destination-port eq 3503
#
acl number 3348
 rule 5 permit udp
 rule 10 permit tcp
 rule 15 permit ip
#
slot 1
 cpu-defend-policy 10
#
return