# Configuring a Zone Defense Policy (AntiDDoS1820-N/Netflow Detection)

After the basic policy is configured, a basic defense policy is automatically generated on each associated device of the Zone to detect inbound traffic.

#### Context

The AntiDDoS1820-N inbound defense policy is used to detect various types of attack traffic. When the rate or bandwidth of the attack traffic exceeds the preset threshold, the AntiDDoS1820-N reports an anomaly event to the ATIC.

- Host Total Traffic Overflow attack

  Attackers send heavy traffic to the target IP address. This attack may cause link congestion, slow server response, and even network crash.

- TCP abnormal packet attack

  TCP packets have six flag bits: URG, ACK, PSH, RST, SYN, and FIN. If any flag bit is abnormal, the TCP packets are considered abnormal.

- TCP SYN Flood attack

  Attackers send SYN packets with forged source addresses to hosts. The hosts reply with SYN-ACK packets to the source addresses, but will not receive any ACK packets. As a result, the hosts keep many half-open connections until the connections time out. These half-open connections can exhaust host resources so that the hosts cannot establish normal TCP connections.

- TCP Fragment Flood attack

  TCP fragments seldom occur in normal network traffic. If the number of TCP fragments increases on the network, DDoS attacks may occur. Attackers send large numbers of TCP fragments to the targets, which bring the following adverse impacts:

  - The large numbers of TCP fragments consume bandwidth resources. As a result, the targets respond slowly or even fail to respond.
  - After receiving large numbers of TCP fragments, network devices or servers reassemble the fragments. As a result, the performance of network devices or servers deteriorates, and even they fail to work properly.

- TCP ACK Flood attack

  Attackers use botnets to send a large number of ACK packets, which bring the following adverse impacts:

  - If attackers send ACK floods with oversized payloads, the links may be congested.
  - If attackers send high-rate ACK floods with changing source IP addresses or ports, the forwarding performances of the network devices that require session resources for packet forwarding may be compromised, or even the network may become paralyzed.
  - If attackers send mass attack packets to overload a server, the server cannot respond to legitimate services.

- TCP RST/FIN Flood attack

  An attacker uses a botnet to send a large number of FIN/RST packets with changing source IP addresses and ports. Such attack packets compromise the performance of session-based forwarding devices or even crash the network to cause a denial of service.

- UDP Flood attack

  Attackers use botnets to send large numbers of oversized UDP packets at a high rate to target servers, which bring the following adverse impacts:

  - The UDP flood attacks exhaust network bandwidth resources or even congest links.
  - The large numbers of UDP attack packets with changing source IP addresses or ports compromise the performance of session-based forwarding devices or even crash the network to cause a denial of service.
  - If the UDP service port of the target server receives attack packets, the server consumes computing resources to verify the attack packets, affecting the processing of legitimate services.

- UDP Fragment Flood attack

  Attackers send large numbers of UDP fragments to the targets, which bring the following adverse impacts:

  - The UDP fragment flood attacks exhaust network bandwidth resources or even congest links.
  - The performance of network devices capable of packet reassembly severely deteriorates.
  - The large numbers of UDP fragments with changing source IP addresses or ports compromise the performance of session-based forwarding devices or even crash the network to cause a denial of service.
  - If the UDP service port of the target server receives attack packets, the server consumes computing resources to verify the attack packets, causing the server to respond slowly or fail to respond to legitimate services.

- DNS Query Flood attack

  DNS Query Flood attacks can be launched on DNS cache servers and DNS authoritative servers.

  - Attacks on cache servers

    Attackers send mass DNS requests carrying invalid domain names to overload the DNS cache server. As a result, the DNS cache server cannot respond to users' DNS requests.

  - Attacks on authoritative servers

    Attackers send mass DNS requests carrying invalid subdomain names to overload the DNS authoritative server. As a result, the DNS authoritative server fails to respond to users' DNS requests.

- DNS Reply Flood attack

  An attacker sends a large number of forged DNS reply packets to a certain DNS server or host to consume server performance.

  The DNS reflection attack is a typical DNS reply flood attack. By imitating the attack target, the attacker sends a large number of DNS query requests to the DNS server and enlarges the reply packets, and forwards them to the attack target to congest the network.

- HTTP Flood attack

  Attackers send mass HTTP packets to the target server using proxies or zombie hosts. Such requests involve operation-related URIs or other resource-consuming URIs to exhaust server resources. For example, portal websites are frequently attacked by HTTP Flood attacks. Such attacks consume server CPU resources or URIs of memory resources, such as database operation-related URIs.

- HTTPS Flood attack

  Attackers launch a large number of HTTPS connections to the target server directly or through proxies or botnets. As a result, the server is overloaded and unable to respond to legitimate requests.

- SIP Flood attack

  SIP is an application-layer signaling control protocol. It is used to create, modify, and release one or more sessions, such as Internet multimedia conferences, IP phone calls, or multimedia distribution. For example, SIP service providers can create new media that include voice, video, and chat content.

  Attackers can send mass INVITE messages to the target SIP server to exhaust the SIP server resources and make the server unable to respond to legitimate call requests. Attackers can also exploit the vulnerabilities of SIP implementation on the VoIP devices to forge and send malformed packets, resulting in the DoS of the SIP server.

- ICMP Flood attack

  Attackers send mass ICMP packets to the target in a short period of time, exhausting session resources on network devices. If the attackers send oversized packets over a network link, the network link may be congested.

- Other Flood attack

  Other Flood attacks refer to service attacks except TCP, UDP, ICMP, DNS, SIP, HTTP, and HTTPS attacks.

- Dark IP attack

  Dark IP addresses indicate the IP addresses that do not appear on the Internet, including:

  - IPv4 addresses

    - 10.0.0.0 to 10.255.255.255
    - 172.16.0.0 to 172.31.255.255
    - 192.168.0.0 to 192.168.255.255

- IPv6 address: FEC0::/10

#### Procedure

1. Choose Defense > Policy Settings > Zone.
2. Click of the Zone.
3. On the Inbound Defense Policy tab, click in the Operation column corresponding to the default defense policies starting with basic.
4. Configure an inbound traffic detection policy for each protocol type.

   Table 1 Inbound traffic detection policy
   Parameter | Description | Recommended Value
   --- | --- | ---
   Host Total Traffic Overflow Detect | PacketRate Threshold | When the rate or bandwidth of the traffic destined for an IP address exceeds the preset threshold, an anomaly event is reported to the ATIC. | Set PacketRate Threshold and Bandwidth Threshold based on the actual network bandwidth settings.
   Bandwidth Threshold
   Tcp Malformed Flood Detect/Defence | PacketRate Threshold | When the rate or bandwidth of abnormal TCP packets exceeds the preset threshold, an anomaly event is reported to the ATIC. | Set PacketRate Threshold and Bandwidth Threshold based on the actual network bandwidth settings.
   Bandwidth Threshold
   Tcp Syn Flood Detect | PacketRate Threshold | When the rate or bandwidth of SYN packets exceeds the preset threshold, an anomaly event is reported to the ATIC. | You are advised to configure parameters based on baseline learning. For details, see Configuring a Baseline Learning Task.
   Bandwidth Threshold
   Tcp Fragment Flood Detect | PacketRate Threshold | When the rate or bandwidth of TCP fragments exceeds the preset threshold, an anomaly event is reported to the ATIC. | You are advised to configure parameters based on baseline learning. For details, see Configuring a Baseline Learning Task.
   Bandwidth Threshold
   Tcp Ack Flood Detect | PacketRate Threshold | When the rate or bandwidth of ACK packets exceeds the preset threshold, an anomaly event is reported to the ATIC. | You are advised to configure parameters based on baseline learning. For details, see Configuring a Baseline Learning Task.
   Bandwidth Threshold
   Tcp Rst/Fin Flood Detect | PacketRate Threshold | When the rate or bandwidth of FIN/RST packets exceeds the preset threshold, an anomaly event is reported to the ATIC. | You are advised to configure parameters based on baseline learning. For details, see Configuring a Baseline Learning Task.
   Bandwidth Threshold
   UDP Flood Detect | PacketRate Threshold | When the rate or bandwidth of UDP packets exceeds the preset threshold, an anomaly event is reported to the ATIC. | You are advised to configure parameters based on baseline learning. For details, see Configuring a Baseline Learning Task.
   Bandwidth Threshold
   UDP Fragment Flood Detect | PacketRate Threshold | When the rate or bandwidth of UDP fragments exceeds the preset threshold, an anomaly event is reported to the ATIC. | You are advised to configure parameters based on baseline learning. For details, see Configuring a Baseline Learning Task.
   Bandwidth Threshold
   DNS Query Flood Detect | PacketRate Threshold | When the rate or bandwidth of DNS Query packets exceeds the preset threshold, an anomaly event is reported to the ATIC. | You are advised to configure parameters based on baseline learning. For details, see Configuring a Baseline Learning Task.
   Bandwidth Threshold
   DNS Reply Flood Detect | PacketRate Threshold | When the rate or bandwidth of DNS Reply packets exceeds the preset threshold, an anomaly event is reported to the ATIC. | You are advised to configure parameters based on baseline learning. For details, see Configuring a Baseline Learning Task.
   Bandwidth Threshold
   HTTP Flood Detect | PacketRate Threshold | When the rate or bandwidth of all HTTP packets, including SYN, SYN-ACK, and ACK packets used for setting up TCP connections, exceeds the preset threshold, an anomaly event is reported to the ATIC. | You are advised to configure parameters based on baseline learning. For details, see Configuring a Baseline Learning Task.
   Bandwidth Threshold
   HTTPS Flood Detect | PacketRate Threshold | When the rate or bandwidth of HTTPS packets exceeds the preset threshold, an anomaly event is reported to the ATIC. | You are advised to configure parameters based on baseline learning. For details, see Configuring a Baseline Learning Task.
   Bandwidth Threshold
   SIP Flood Detect | PacketRate Threshold | When the rate or bandwidth of SIP packets exceeds the preset threshold, an anomaly event is reported to the ATIC. | You are advised to configure parameters based on baseline learning. For details, see Configuring a Baseline Learning Task.
   Bandwidth Threshold
   ICMP Flood Detect | PacketRate Threshold | When the rate or bandwidth of ICMP packets exceeds the preset threshold, an anomaly event is reported to the ATIC. | You are advised to configure parameters based on baseline learning. For details, see Configuring a Baseline Learning Task.
   Bandwidth Threshold
   Other Flood Detect | PacketRate Threshold | When the rate or bandwidth of service packets except TCP, UDP, ICMP, DNS, SIP, HTTP, and HTTPS packets exceeds the preset threshold, an anomaly event is reported to the ATIC. | You are advised to configure parameters based on baseline learning. For details, see Configuring a Baseline Learning Task.
   Bandwidth Threshold
   Dark Ip Detect | PacketRate Threshold | When the rate or bandwidth of the traffic destined for an unavailable public IP address exceeds the preset threshold, an anomaly event is reported to the ATIC. | Set PacketRate Threshold and Bandwidth Threshold based on the actual network bandwidth settings.
   Bandwidth Threshold

5. (Optional) If the Zone is associated with multiple devices, click on the Inbound Defense Policy tab to copy the defense policy configuration from an associated device to another.

Parent topic: Configuring the Zone-based Defense Policy

Copyright © Huawei Technologies Co., Ltd.