3.2.25. ddos-protection¶
Note
requires a DDoS protection License.
Global DDoS protection configuration.
vsr running config# ddos-protection
enabled¶
Enable/Disable DDoS protection feature.
vsr running config# ddos-protection
vsr running ddos-protection# enabled true|false
- Default value
true
tcp¶
Thresholds limiting TCP packets.
vsr running config# ddos-protection tcp
syn¶
Thresholds limiting TCP SYN packets.
vsr running config# ddos-protection tcp
vsr running tcp# syn global GLOBAL source SOURCE destination DESTINATION \
... unit UNIT
global¶
System global threshold.
global GLOBAL
|
Rate in pps/bps. K/M/G/T multipliers are supported. |
source¶
Per source IP address threshold.
source SOURCE
|
Rate in pps/bps. K/M/G/T multipliers are supported. |
destination¶
Per destination IP address threshold.
destination DESTINATION
|
Rate in pps/bps. K/M/G/T multipliers are supported. |
unit¶
Thresholds unit.
unit UNIT
|
Description |
|---|---|
|
Thresholds are expressed in packets per second. |
|
Thresholds are expressed in bits per second. |
- Default value
pps
syn-ack¶
Thresholds limiting TCP SYN-ACK packets.
vsr running config# ddos-protection tcp
vsr running tcp# syn-ack global GLOBAL source SOURCE destination DESTINATION \
... unit UNIT
global¶
System global threshold.
global GLOBAL
|
Rate in pps/bps. K/M/G/T multipliers are supported. |
source¶
Per source IP address threshold.
source SOURCE
|
Rate in pps/bps. K/M/G/T multipliers are supported. |
destination¶
Per destination IP address threshold.
destination DESTINATION
|
Rate in pps/bps. K/M/G/T multipliers are supported. |
unit¶
Thresholds unit.
unit UNIT
|
Description |
|---|---|
|
Thresholds are expressed in packets per second. |
|
Thresholds are expressed in bits per second. |
- Default value
pps
ack¶
Thresholds limiting TCP ACK packets.
vsr running config# ddos-protection tcp
vsr running tcp# ack global GLOBAL source SOURCE destination DESTINATION \
... unit UNIT
global¶
System global threshold.
global GLOBAL
|
Rate in pps/bps. K/M/G/T multipliers are supported. |
source¶
Per source IP address threshold.
source SOURCE
|
Rate in pps/bps. K/M/G/T multipliers are supported. |
destination¶
Per destination IP address threshold.
destination DESTINATION
|
Rate in pps/bps. K/M/G/T multipliers are supported. |
unit¶
Thresholds unit.
unit UNIT
|
Description |
|---|---|
|
Thresholds are expressed in packets per second. |
|
Thresholds are expressed in bits per second. |
- Default value
pps
rst¶
Thresholds limiting TCP RST packets.
vsr running config# ddos-protection tcp
vsr running tcp# rst global GLOBAL source SOURCE destination DESTINATION \
... unit UNIT
global¶
System global threshold.
global GLOBAL
|
Rate in pps/bps. K/M/G/T multipliers are supported. |
source¶
Per source IP address threshold.
source SOURCE
|
Rate in pps/bps. K/M/G/T multipliers are supported. |
destination¶
Per destination IP address threshold.
destination DESTINATION
|
Rate in pps/bps. K/M/G/T multipliers are supported. |
unit¶
Thresholds unit.
unit UNIT
|
Description |
|---|---|
|
Thresholds are expressed in packets per second. |
|
Thresholds are expressed in bits per second. |
- Default value
pps
udp¶
Thresholds limiting UDP packets.
vsr running config# ddos-protection udp
dns¶
Thresholds limiting UDP DNS packets.
vsr running config# ddos-protection udp
vsr running udp# dns global GLOBAL source SOURCE destination DESTINATION \
... unit UNIT
global¶
System global threshold.
global GLOBAL
|
Rate in pps/bps. K/M/G/T multipliers are supported. |
source¶
Per source IP address threshold.
source SOURCE
|
Rate in pps/bps. K/M/G/T multipliers are supported. |
destination¶
Per destination IP address threshold.
destination DESTINATION
|
Rate in pps/bps. K/M/G/T multipliers are supported. |
unit¶
Thresholds unit.
unit UNIT
|
Description |
|---|---|
|
Thresholds are expressed in packets per second. |
|
Thresholds are expressed in bits per second. |
- Default value
pps
quic¶
Thresholds limiting UDP QUIC packets.
vsr running config# ddos-protection udp
vsr running udp# quic global GLOBAL source SOURCE destination DESTINATION \
... unit UNIT
global¶
System global threshold.
global GLOBAL
|
Rate in pps/bps. K/M/G/T multipliers are supported. |
source¶
Per source IP address threshold.
source SOURCE
|
Rate in pps/bps. K/M/G/T multipliers are supported. |
destination¶
Per destination IP address threshold.
destination DESTINATION
|
Rate in pps/bps. K/M/G/T multipliers are supported. |
unit¶
Thresholds unit.
unit UNIT
|
Description |
|---|---|
|
Thresholds are expressed in packets per second. |
|
Thresholds are expressed in bits per second. |
- Default value
pps
raw¶
Thresholds limiting UDP RAW (i.e. neither DNS or QUIC) packets.
vsr running config# ddos-protection udp
vsr running udp# raw global GLOBAL source SOURCE destination DESTINATION \
... unit UNIT
global¶
System global threshold.
global GLOBAL
|
Rate in pps/bps. K/M/G/T multipliers are supported. |
source¶
Per source IP address threshold.
source SOURCE
|
Rate in pps/bps. K/M/G/T multipliers are supported. |
destination¶
Per destination IP address threshold.
destination DESTINATION
|
Rate in pps/bps. K/M/G/T multipliers are supported. |
unit¶
Thresholds unit.
unit UNIT
|
Description |
|---|---|
|
Thresholds are expressed in packets per second. |
|
Thresholds are expressed in bits per second. |
- Default value
pps
icmp¶
Thresholds limiting ICMP packets.
vsr running config# ddos-protection icmp
echo¶
Thresholds limiting ICMP ECHO packets.
vsr running config# ddos-protection icmp
vsr running icmp# echo global GLOBAL source SOURCE destination DESTINATION \
... unit UNIT
global¶
System global threshold.
global GLOBAL
|
Rate in pps/bps. K/M/G/T multipliers are supported. |
source¶
Per source IP address threshold.
source SOURCE
|
Rate in pps/bps. K/M/G/T multipliers are supported. |
destination¶
Per destination IP address threshold.
destination DESTINATION
|
Rate in pps/bps. K/M/G/T multipliers are supported. |
unit¶
Thresholds unit.
unit UNIT
|
Description |
|---|---|
|
Thresholds are expressed in packets per second. |
|
Thresholds are expressed in bits per second. |
- Default value
pps
trusted¶
Trusted IP addresses.
vsr running config# ddos-protection trusted
ipv4¶
Trusted IPv4 address.
vsr running config# ddos-protection trusted
vsr running trusted# ipv4 IPV4
|
An IPv4 address which is not multicast (224.0.0.0 to 239.255.255.255 are rejected). |
ipv6¶
Trusted IPv6 address.
vsr running config# ddos-protection trusted
vsr running trusted# ipv6 IPV6
|
An IPv6 address which is not multicast (the range of ff00::/8 is rejected). |