Table Of Contents

A - B - C - D - E - F - G - H - I - J - K - L - M - N - O - P - R - S - T - U - V - W - X - Z

Index

A

AAA

accounting3-13

authentication3-5

authorization3-11

configuring3-3

aaa accounting command3-13

aaa authentication command3-5

aaa authorization command3-11

accounting, configuring3-13

action command7-23

action flow9-14

add-service command7-12

admin privilege level2-9

always-accept7-25

always-ignore7-25

analysis module1-6, 7-14

anomaly

detected9-4

flow9-12

anti-spoofing drop statistics11-10

arp command10-15

attack report

copying9-15

detected anomalies9-4

dropped/replied packets9-3

exporting9-15

history10-9

layout9-2

mitigated attacks9-5

statistics9-3

timing9-2

viewing9-12, 11-5

attack statistics11-6

attack type

client9-8

malformed packets9-9

spoofed9-6

user defined9-9

zombie9-8, 9-10

authentication, configuring3-5

authorization, configuring3-8, 3-9

auth packet types7-15

automatic protection mode1-5

B

bad packets to proxy drop statistics11-10

basic

module7-14

User filter actions6-12

basic module1-6

Berkley Packet filter6-6

BGP

announcement4-20

Cisco router configuration exampleA-7

configurationA-3

configuration exampleA-6

diverting method4-8

Guard configuratioA-11

Guard configurationA-4

Juniper router configuration exampleA-8

block Dynamic filter actions6-17

block-unauthenticated policy action7-24

burn flash10-27

Bypass filter1-6

command6-10

configuring11-5

definition6-3

deleting6-11

viewing6-11

C

caution

symbol overviewxxvi

CFE10-25, 10-27

clear log command10-7

CLI

changing prompt3-22

command shortcuts2-15

error messages2-13

getting help2-14

issuing commands2-11

TAB completion2-14

using2-9

client attack mitigated attacks9-8

command line interface

See CLI2-9

command shortcuts2-15

config privilege level2-9

configuration

file

copying10-9

exporting10-10

importing10-10

viewing3-17

configure command2-17

console

connecting2-8

local connection2-9

constructing policies5-9

copy commands

ftp running-config10-11

log10-4, 10-6

new-version10-25

reports9-15

running-config10-10

zone log10-6

copy-services command7-27

counters, viewing5-17

cpu utilization10-15

D

date command3-18, 3-19

DDoS

attack classification11-6

overview1-1

deactivating protection5-16

default-gateway command2-24

description command5-4

detected

anomalies9-4

flow9-14

diagnostics10-12

diff command7-26

disable command7-10

disk usage10-8

distributed denial of service

See DDoS

diversion4-2

BGPA-1

BGP diverting method4-8, A-4

dynamic next hop4-10

layer 2 topology4-5

layer 3 topology4-4

long diversion4-7, 4-19, A-38

static next hop4-9

troubleshooting11-2

TunnelA-35

tunnel4-18, A-35

divert-from router4-2

DNS

detected anomalies9-5

drop statistics11-9, 11-10

TCP policy templates7-4

drop

Dynamic filter action6-17

policy action7-21, 7-24

statistics11-7

User filter action6-13

drop module1-6

dropped packets9-3

drop-statistics command11-7

dst traffic characteristics7-16

Dynamic filter1-6

actions6-17

command6-17, 6-21

deleting6-21, 11-4

inactivating6-22, 11-4

input to6-3

overview6-16

preventing production of6-21

sorting6-18

terminating6-22

viewing6-18, 11-4

zone malicious rate6-22

dynamic privilege level2-9

E

enable

command3-10, 7-10

password command3-9

enabling services3-2

event log10-4

event monitor command10-4

export command10-5

exporting

configuration file10-10

log file10-6

F

facility10-5

FBF

Juniper router configuration exampleA-16

filter rate

termination threshold6-22

filters

Bypass1-6, 6-10

Dynamic1-6, 6-16

Flex1-6, 6-6

overview6-1

User1-6, 6-12

filter-termination command6-22

first-hit3-16

flash-burn command10-27

Flex filter1-6

command6-6

configuring6-6

default configuration3-26

definition6-3

deleting6-6

viewing6-9

forwarding4-8, A-9

Layer 2A-9

layer 24-11

layer 34-11

PBR-DSTA-12

PBR -VLANA-23

PBR VLAN4-14

policy based routingA-12

VLAN VRF4-15

VPN routingA-19

VRF4-12

VRF-VLANA-26

fragments

detected anomalies9-5

policy template7-4

front panel2-2

G

global traffic characteristics7-16

GRE

See tunnel2-21

Guard

self protection3-25

H

history command10-9

host, logging10-5

hostname

changing3-22

command3-22

HTTP

detected anomalies9-4

policy template7-5

I

in-band

configuring interface2-18

incoming TCP drop statistics11-8

injecting traffic4-23

inject-to router4-2

in packet types7-15

install new-version command10-25

interactive

operation mode8-3

policy status7-25

interactive protection mode1-5

interactive-status command7-25

interface

activating2-18, 2-19

command2-18, 2-19, 2-20, 2-21

configuring2-18

configuring IP address2-18to 2-21

loopback2-20

out-of-band2-17

ip address command2-21

interface2-18to 2-21

zone5-3

IPIP

See tunnel2-21

ip route command2-25

IP scan

detected anomalies9-5

policy template7-5

J

Juniper

routing instanceA-31

routing instances4-16

K

keepalive command2-23

key command

add3-20

remove3-21

L

L2F4-11, A-9

configurationA-11

router configurationA-12

land attack drop statistics11-10

layer 2 topology4-5

layer 3 topology4-4

learning

command5-10, 5-13

constructing policies5-9

overview5-8

policy-construction command5-9

terminating process5-10, 5-13

threshold-tuning command5-11

tuning thresholds5-11

LINK templates5-9

log file

clearing10-7

exporting10-4, 10-6

history10-9

viewing10-6

logging, viewing configuration10-6

logging command10-5

long diversion4-7, 4-19, A-38

Cisco router configurationA-41

Guard configurationA-40

loopback interface2-20

M

malformed packets

mitigated attacks9-9

malformed packets drop statistics11-10

malicious rate termination threshold6-22

management

overview2-16

SSH2-28

WBM2-27

max-services command7-9

memory consumption10-14

min-threshold command7-9

mitigated attacks

client attack9-8

malformed packets9-9

overview9-5

spoofed9-6

user defined9-9

zombie9-6

modules

analysis1-6, 7-14

basic1-6, 7-14

drop1-6

overview7-14

rate limiter1-6, 6-10

recognition1-6, 10-14

strong1-6, 7-14

MPLS LSP4-22

mtu command2-19, 2-20, 2-22

N

netstat command10-18

new version

installing10-25

upgrading10-25

next hop discovery4-24

IGP4-26

IGP + BGP4-27

routing protocols4-24

next-hop router4-2

no learning command5-10, 5-13

non DNS drop statistics11-10

no proxy policy templates7-7

notify policy action7-21, 7-24

ns policy templates7-7

NTP3-19

enable service3-19

permit3-19

server3-20

num_sources packet type7-15

O

on-demand5-16

other protocols

detected anomalies9-5

policy template7-5

other protocols drop statistics11-8

out_pkts packet types7-15

outgoing TCP drop statistics11-8

out-of-band

configuring interface2-18

out-of-band interface2-17

P

password

changing3-7

enabling3-9

password, recovering10-28

PBR4-9, 4-11

PBR-DSTA-12

Cisco router configurationA-15

configurationA-13

exampleA-15

Guard configurationA-14

PBR -VLANA-23

PBR -VLAN

Guard configurationA-24

PBR VLAN4-14

pending filters

viewing8-6

permit

command2-27, 2-28, 3-3

User filter action6-12

ping command10-22

pkts packet type7-15

policy

action7-18, 7-23, 7-24

activating7-19

adding services7-12

command7-17, 7-18

constructing1-4, 5-8, 5-9, 7-4

copy-services7-27

deleting service7-13

disabling7-19

inactivating7-19

multiplying thresholds7-21, 11-3, 11-4

packet types7-14

proxy threshold7-22

show statistics7-30

state7-19

structure7-2

threshold7-4, 7-18, 7-20

timeout7-18, 7-23

traffic characteristics7-16

tuning thresholds1-4, 5-8, 5-11, 7-4

viewing11-4

viewing statistics5-13, 7-30

Policy Based Routing4-9

policy-based routingA-12

policy template

command7-7, 7-8, 7-10

configuration command level7-8

max-services7-9

min-threshold7-9

overview7-4

parameters7-8

state7-10

port scan

detected anomalies9-5

policy template7-5

poweroff command2-29

pPossible next-hop routers4-2

privilege levels2-9

assigning passwords3-9

moving between3-10

protect

automatic mode1-5

command5-14

deactivating automatically5-16

interactive mode1-5

on-demand5-16

specific IP5-15

termination timeout5-15

protection-end-timer command5-16

protocol traffic characteristics7-16

proxy

command2-26

configuring2-26

no proxy policy templates7-7

proxy-threshold command7-22

R

rack mount specifications2-1

rate-limit command5-4

rate limiter module1-6, 6-10

rates, viewing5-17

reactivate-zones2-29

rear panel2-3

reboot command2-29

rebooting

parameters2-29

recognition module1-6, 10-14

recommendations

accepting8-8

activating8-3, 8-7

command8-7

deactivating8-3

ignoring8-8

overview8-2

receiving notification8-2

viewing8-2, 8-3

viewing pending-filters8-6

redirect/zombie

Dynamic filter action6-17

policy action7-24

reload command2-28

renumbering User filters6-13

replied packets9-3

report

See attack report9-2

reports

details9-12

reqs packet type7-15

routing instanceA-31

routing instances4-16

routing table

GRMB-6

manipulation2-24

viewing2-25

zebra applicationB-6

running-config

copy10-10

copy ftp10-11

show3-17

S

self-protection command3-25

service

adding7-12

command2-27, 3-2

deleting7-13

permissions3-3

snmp-trap3-23

wbm2-27

services

enabling3-2

set-action7-24

show commands

counters5-17

cpu10-15

diagnostic-info10-13

disk-usage10-8

drop-statistics11-7

dynamic-filters6-18, 11-4

log10-6

log export-ip10-6

logging10-6

memory10-14

policies7-29, 11-2, 11-4

policies statistics5-13, 7-30

rates5-17, 11-1

recommendations8-4, 8-5

recommendations pending-filters8-6

reports11-5

reports details9-12

running-config3-17

show10-2

sorting dynamic-filters6-18

templates5-7

zone policies7-29

show privilege level2-9

shutdown command2-19

snapshot command7-25

SNMP, configuring trap generator3-23

snmp commands

community3-25

trap-dest3-23

source IP

tunnel2-22

specific IP threshold7-21

spoofed attacks9-6

src traffic characteristics7-16

SSH

configuring2-28

deleting keys3-21

state command7-20, 11-4

static route

adding2-24

strong

Dynamic filter action6-17

module1-6, 7-14

policy action7-21, 7-24

User filter action6-13

syn_by_fin packet type7-15

syns packet type7-15

syslog

configuring export parameters10-5

configuring server10-5

message format10-4

T

TACACS+

clearing statistics3-17

configuring search3-15

configuring server3-14

server connection timeout3-16

server encryption key3-15

server IP address3-15

viewing statistics3-17

tacacs-server commands

clear statistics3-17

first-hit3-16

host3-15

key3-15

show statistics3-17

timeout3-16

TCP

detected anomalies9-4

drop statistics11-9, 11-10

no proxy policy templates7-7

policy templates7-5

templates

LINK5-9

viewing policies5-7

zone5-6

thresh-mult7-21, 11-3, 11-4

threshold

command7-20

configuring specific IP7-21

filter rate termination6-22

malicious rate termination6-22

multiplying11-3, 11-4

tuning1-4, 5-8

time, configuring3-18

timeout command7-23

timezone3-19

to-user-filters

Dynamic filter action6-17

policy action7-21, 7-24

traceroute command10-21

traffic forwarding4-8, A-9

traffic injection4-23

trap10-5

trap-dest3-23

tuning policy thresholds5-11

tunnel

commands2-22

configuring2-21

GRE keepalive2-23

tunnel diversion4-18, A-35

Cisco router configurationA-37

Guard configurationA-36

U

UDP

detected anomalies9-5

drop statistics11-9

policy templates7-6

unauthenticated drop statistics11-8

unauth_pkts packet type7-15

unauthenticated TCP detected anomalies9-4

upgrading10-25

USB

connecting mini cable2-6

user

detected anomalies9-5

user defined mitigated attacks9-9

User filter1-6

actions6-12

command6-13

configuring6-12

definition6-3

deleting6-16

input to6-3

renumbering6-13

viewing6-15

username command3-6

users

adding3-6

adding new3-6

assigning privilege levels3-6

deleting3-7

privilege levels2-9, 3-9

V

VLAN

configuring2-19

VLAN policy based routingA-23

VLAN VPN routing forwardingA-26

VLAN VRF4-15

VPN Routing Forwarding4-9

VPN routing forwardingA-19

VRF4-9, 4-12

VRF - DST

Guard configurationA-20

VRF -DST

Cisco router configurationA-21

VRF - VLANA-26

W

warning

symbol overviewxxvi

WBM

activating2-27

X

XML schema??to9-17

Z

zebra routing tableB-6

zombie

packet counter5-18

zombie attack9-6, 9-14

zone

blocking criteria11-3

blocking flows11-2

command5-5, 5-7, 8-3

copying5-7

creating5-5

definition1-3

duplicating5-7

IP address5-3

learning5-8

LINK templates5-9

operation mode5-5

protecting5-14

reconfiguring5-3

templates5-6

viewing configuration5-5

viewing policies7-29

viewing status10-2

zone-malicious-rate6-22