auto-defend action
Function
The auto-defend action command configures the device to discard packets sent from attack sources.
The undo auto-defend action command configures the device not to discard packets sent from attack sources.
By default, the device does not discard packets sent from attack sources.
Usage Guidelines
Usage Scenario
The attack source tracing process consists of four phases: packet parsing, traffic analysis, attack source identification, and attack source punishment. The auto-defend action command is applied to the attack source punishment phase. The device discards the packets sent from the identified source.
The auto-defend action command configures the device to punish attack sources. When the device detects an attacker, it discards packets sent from the attack source. This protects the device against attacks.
Prerequisites
Attack source tracing has been enabled using the auto-defend enable command.
Precautions
The device punishes an attack source during the duration specified by timer time-length. When the duration expires, the device stops discarding packets sent from this attack source. If the attack source continues attacking the device, the device starts to discard packets sent from this attack source again.
Example
# Configure the device to discard packets sent from an attack source, and set the duration to 20000 seconds.
<AC6605> system-view [AC6605] cpu-defend policy mypolicy [AC6605-cpu-defend-policy-mypolicy] auto-defend enable [AC6605-cpu-defend-policy-mypolicy] auto-defend action deny timer 20000
