Table Of Contents
Symbols - A - B - C - D - E - F - G - H - I - K - L - M - N - O - P - R - S - T - U - V - W - X - Z
Index
Symbols
# (number sign) 11-8
* (wildcard) 2-6, 5-4, 11-8
A
AAA
accounting 3-13
authentication 3-5
authorization 3-11
configuring 3-4
aaa accounting command 3-13
aaa authentication command 3-5
aaa authorization command 3-11
accounting, configuring 3-13
action command 7-19
action flow 11-11
activation
activation-extent command 9-7
activation-interface command 9-4
interface 9-4
method 9-4
sensitivity 9-6
add-service command 7-9
admin privilege level 2-2, 3-7
always-accept 7-21
always-ignore 7-21
analysis protection level 1-5, 7-10
anomaly
detected 11-3
flow 11-8
anomaly detection engine memory usage 12-24, 12-25
anti-spoofing 1-2
anti-spoofing drop statistics 14-7
anti-zombie 1-3
arp command 12-26
attack-detection command 9-8
attack report
copying 11-12
detected anomalies 11-3
exporting 11-11, 11-12
exporting automatically 11-12
history 12-23
layout 11-1
malicious packets statistics 11-2
mitigated attacks 11-4
notify 11-8
statistics 11-2
timing 11-1
viewing 11-8, 14-4
attack reports
exporting 13-6
attack statistics 14-5
attack type
client 11-5
malformed packets 11-6
mitigated attack 11-9
user defined 11-6
zombie 11-5, 11-7
authentication, configuring 3-5
authorization
configuring 3-8, 3-9
disabling zone command completion 3-13, 5-6
auth packet types 7-11
automatic protect mode 1-5, 9-3, 10-1
B
bad packets to proxy drop statistics 14-7
banner
configuring login 3-29
basic
user filter actions 6-14
basic protection level 1-5, 7-10
Berkeley Packet filter 6-8
BGP
announcement A-13
Cisco router configuration example 4-6
configuration 4-2
configuration example 4-4
diverting method A-5
Guard configuration 4-3, 4-8
block dynamic filter actions 6-19
block-unauthenticated policy action 7-19
burn flash 13-9
bypass filter
command 6-11
configuring 14-4
definition 1-5, 6-2
deleting 6-13
displaying 6-12
C
capture, packets 12-12
caution
symbol overview 1-xix
clear counters command 2-12, 12-4
clear log command 12-9
CLI
changing prompt 3-25
command shortcuts 2-6
error messages 2-5
getting help 2-5
issuing commands 2-3
TAB completion 2-5
using 2-1
client attack 11-9
client attack mitigated attacks 11-5
command completion 3-13
command line interface
See CLI 2-1
command shortcuts 2-6
Common Firmware Environment (CFE) 13-9
comparator 6-3
config privilege level 2-2, 3-7
configuration
saving 4-1
configuration, accessing command mode 3-12
configuration file
copying 13-2
exporting 13-2
importing 13-4
viewing 12-1
configuration mode 2-2
configure command 2-7
constructing policies 8-4
copy commands
ftp running-config 13-4
log 12-6, 12-8
new-version 13-8
packet-dump 12-15
reports 11-12
running-config 5-11, 13-2
zone log 12-8
copy-from-this 5-5
copy guard-running-config command 5-10
copy login-banner command 3-30
copy-policies command 8-16
copy wbm-logo command 3-32
counters
clearing 2-12, 12-4
history 12-3
counters, viewing 12-3
cpu utilization 12-24
D
date command 3-21, 3-22
DDoS
attack classification 14-5
nonspoofed attacks 1-2
overview 1-2
spoofed attacks 1-2
zombies 1-3
deactivate command 9-11
deactivating commands 2-4
deactivating protection 9-8
default-gateway command 2-13
default zone 9-6
description command 5-6
detected
anomalies 11-3
flow 11-11
diff command 8-14
disable command 7-6
disabling
automatic export 13-6
disk usage 12-23
distributed denial of service
See DDoS
diversion A-2
BGP 4-1
BGP diverting method 4-3, A-5
dynamic next hop A-7
layer 2 topology A-4
layer 3 topology A-3
long diversion 4-22, A-4, A-12
static next hop A-6
troubleshooting 14-2
tunnel 4-20, A-11
divert-from router 4-6, A-1
DNS
detected anomalies 11-3
drop statistics 14-6, 14-7
TCP policy templates 7-2
drop
dynamic filter action 6-18
policy action 7-19
statistics 14-6
user filter action 6-14
dropped packets
learning 8-1
drop-statistics command 14-5
dst traffic characteristics 7-11
dynamic filter
1000 and more 6-20
actions 6-13, 6-18
command 6-21, 6-22
deactivating 6-23
definition 1-5
deleting 6-22, 14-3
displaying 6-19, 14-3
displaying events 12-7
inactivating 14-3
overview 6-2, 6-18
preventing production of 6-23
sorting 6-19
terminating 6-23
zone malicious rate 6-23
dynamic filters 10-1
dynamic privilege level 2-2, 3-7
E
enable
command 3-10, 7-6
password command 3-9
enabling services 3-2
even log
deactivating 12-6
event log
activating 12-6
event monitor command 12-6
export
disabling automatic 13-6
export command 13-6
packet-dump 12-14
reports 11-12
exporting
configuration file 13-2
log file 12-8
reports automatically 11-12
exporting GUARD configuration 5-10
extracting signatures 12-18
F
facility 12-6
file-server
command 13-1
configuring 13-1
deleting 13-2
displaying 13-2, 13-6
file server, displaying sync-config 13-6
filter rate
termination threshold 6-23
filters
bypass 1-5, 6-11
dynamic 1-5, 6-2, 6-18
flex-content 1-5, 6-3
overview 6-1
user 1-5, 6-13
filter-termination command 6-23
fixed-threshold 7-15
flash-burn command 13-9
flex-content filter
configuring 6-4
default configuration 12-33
definition 1-5, 6-2
displaying 6-9
dropped 14-6
filtering criteria 6-3
renumbering 6-4
forwarding 4-6, A-6
Layer 2 4-7
layer 2 A-7
layer 3 A-8
PBR-DST 4-9
PBR VLAN A-9
policy based routing 4-9
VLAN VRF A-10
VPN routing 4-11
VRF A-8
VRF-VLAN 4-17
fragments
detected anomalies 11-3
policy template 7-2
G
generating signatures 12-18
global mode 2-2
global traffic characteristics 7-12
GRE
See tunnel 2-10
Guard
self protection 12-32
GUARD_DEFAULT 5-2
GUARD_LINK 5-2
GUARD_TCP_NO_ PROXY 5-2
Guard configuration
resetting 13-12
GUARD configuration, exporting 5-10
GUARD configuration, importing 5-11
H
hijacking traffic A-1
history command 12-23
host, logging 12-7
host keys
deleting 3-20, 3-21
hostname
changing 3-25
command 3-25
HTTP
detected anomalies 11-3
policy template 7-2
hybrid 11-9
I
idle session, configuring timeout 3-33
idle session, displaying timeout 3-33
importing
configuration 13-4
GUARD configuration 5-11
in-band
configuring interface 2-8
incoming TCP drop statistics 14-6
injecting traffic A-1, A-14
inject-to router 4-6, A-1
in packet types 7-11
install new-version command 13-8
interactive
operation mode 10-3
policy status 7-21
interactive protect mode 1-5, 9-3, 10-1
interactive-status command 7-20
interface
activating 2-7, 2-9
clearing counters 2-12
command 2-8, 2-9, 2-10, 2-11
configuration mode 2-2
configuring 2-8
configuring IP address2-8to 2-10, 2-11
loopback 2-10
out-of-band 2-7
IP address
modifying, zone 5-8
ip address command 2-11
deleting 5-8
excluding 5-7
interface2-8to 2-10
zone 5-7, 9-3
IPIP
See tunnel 2-10
ip route command 2-13
IP scan
detected anomalies 11-3
policy template 7-2
IP threshold configuration 7-17
K
keepalive command 2-12
key command
add 3-21, 3-23
generate 3-25
remove 3-24
L
L2F 4-7, A-7
configuration 4-8
router configuration 4-8
land attack drop statistics 14-7
layer 2 topology A-4
layer 3 topology A-3
learning
command 8-5, 8-7
constructing policies 8-4
dropped packets 8-1
overview 8-1
policy-construction command 8-5
synchronizing results 8-3
terminating process 8-5, 8-7
threshold-tuning command 8-6
tuning thresholds 8-6
learning accept command 8-5, 8-7
learning params
threshold-selection command 8-9
learning-params
deactivating periodic action 8-7
deactivating periodic-action command 8-5
periodic-action command 8-5, 8-7, 8-9
threshold-multiplier command 7-15
threshold-selection command 8-7
threshold-tuned command 5-8, 8-10
learning-params fixed-threshold command 7-15
LINK templates 8-4
log
displaying subzones 9-8
log file
clearing 12-9
exporting 12-6, 12-8
history 12-23
viewing 12-8
logging, viewing configuration 12-7
logging command 12-6
login banner
configuring 3-29, 3-30
deleting 3-31
importing 3-30
login-banner command 3-30
logo, adding WBM 3-31
logo, deleting WBM 3-32
long diversion 4-22, A-4, A-12
Cisco router configuration 4-24
Guard configuration 4-23
loopback interface 2-10
M
malformed packets 11-9
mitigated attacks 11-6
malformed packets drop statistics 14-7
malicious packets statistics
attack report 11-2
malicious rate termination threshold 6-23
management
MDM 2-16
overview 2-14
SSH 2-17
WBM 2-15
max-services command 7-5
MDM
activating 2-16
memory consumption 12-23
memory usage, anomaly detection engine 12-24, 12-25
MIB, supported 3-2
min-threshold command 7-5
mitigated attacks
client attack 11-5
malformed packets 11-6
overview 11-4
spoofed 11-4
user defined 11-6
monitoring
network traffic 12-14, 12-15
MP
upgrading 13-8
MPLS LSP A-13
mtu command 2-8, 2-10, 2-11
N
netstat command 12-27
network server
configuring 13-1
deleting 13-2
displaying 13-2, 13-6
network server, displaying sync-config 13-6
new version
installing 13-8
upgrading 13-8
next hop discovery A-15
IGP + BGP A-17
next-hop router 4-6, A-1
no learning command 8-5, 8-7
non DNS drop statistics 14-7
nonspoofed attacks 1-2
no proxy policy templates 7-4
note
symbol overview 1-xix
notify 11-8
notify policy action 7-20
ns policy templates 7-4
NTP
enable service 3-22
permit 3-23
server 3-23
num_sources packet type 7-11
O
other protocols
detected anomalies 11-3
policy template 7-2
other protocols drop statistics 14-6
out_pkts packet types 7-11
outgoing TCP drop statistics 14-6
out-of-band
configuring interface 2-8
out-of-band interface 2-7
P
packet-dump
auto-capture command 12-11
automatic
activating 12-10
deactivating 12-11
displaying settings 12-11
exporting 12-14, 12-15, 13-6
signatures 12-19
packet-dump command 12-12
packets, capturing 12-12
password
changing 3-7
enabling 3-9
encrypted 3-7
resetting 13-10
PBR A-6, A-8
PBR-DST 4-9
Cisco router configuration 4-10
configuration 4-9
example 4-11
Guard configuration 4-10
PBR -VLAN
Guard configuration 4-15
PBR VLAN A-9
pending 10-1
pending dynamic filters 10-1, 10-2
displaying 10-3, 10-5
periodic action
accepting policies automatically 8-5, 8-7
deactivating 8-5, 8-7
permit
command 2-15, 2-16, 2-17, 3-3
user filter action 6-14
permit ssh command 3-21
ping command 12-30
pkts packet type 7-11
policy
action 7-12, 7-19, 7-20
activating 7-13
adding services 7-8
backing up current 7-24, 8-17
command 7-12
configuration mode 2-3
constructing 1-4, 8-2, 8-4
copying parameters 8-16
copy-policies 8-16
deleting services 7-9
disabling 7-13
inactivating 7-13
learning-params, fixed-threshold command 7-15
marking as tuned 5-8, 8-10
marking threshold as fixed 7-15
multiplying thresholds 7-16, 14-2, 14-3
navigating path 7-12
packet types 7-10
proxy threshold 7-18
show statistics 7-22
state 7-13
threshold 7-12, 7-14
threshold-list command 7-17
timeout 7-12, 7-18
traffic characteristics 7-11
tuning thresholds 1-4, 8-2, 8-6
using wildcards 7-12, 7-21, 7-23
viewing 14-3
viewing statistics 8-8
policy-based routing 4-9, A-6
policy set-timeout command 7-19
policy template
command 7-4, 7-6
configuration command level 7-4
configuration mode 2-3
displaying list 7-4
max-services 7-5
min-threshold 7-5
overview 7-2
parameters 7-4
state 7-6
policy-template add-service command 7-9
policy-template remove service command 7-9
port scan
detected anomalies 11-3
policy template 7-2
possible next-hop routers A-1
poweroff command 13-7
privilege levels 2-1
assigning passwords 3-9
moving between 3-10
protect
activating 2-14
automatic mode 1-5, 10-1
command 9-9
deactivating 9-11
deactivating automatically 9-8
entire zone 9-9
interactive mode 1-5, 9-3, 10-1
specific IP 9-10
specific ip address 9-10
specific zone IP 9-10
specific zone ip address 9-10
protect command 9-11
protection
activation sensitivity 9-6
protection-end-timer command 9-8
protection level
analysis 1-5, 7-10
basic 1-5, 7-10
strong 1-5, 7-10
protect learning command 8-6
protect-packet command 9-6
protocol traffic characteristics 7-12
proxy
command 2-14
configuring 2-14
no proxy policy templates 7-4
proxy-threshold command 7-18
public-key
displaying 3-25
R
rate-limit command 5-6, 6-11
Rate Limiter
dropped 14-6
rates
history 12-3
rates, viewing 12-3
reactivate-zones 13-7
reboot command 13-7
rebooting
parameters 13-7
recommendations 10-1
accepting 10-6
activating 10-3, 10-5
change decision 7-20
command 10-6
deactivating 10-3, 10-7
displaying 10-2
dynamic filters 10-1
ignoring 10-6
overview 10-1
receiving notification 10-2
viewing 10-4
viewing pending-filters 10-3, 10-5
redirect/zombie
dynamic filter action 6-19
policy action 7-20
reload command 13-6
remove service command 7-9
renumbering flex-content filters 6-4
renumbering user filters 6-15
replied packets 11-2
report
See attack report 11-1
reports
details 11-8
displaying subzones 9-8
exporting 13-6
reqs packet type 7-11
router configuration mode 2-2
routing table
GRM B-3
manipulation 2-13
viewing 2-14
zebra application B-3
RTP/RTCP 5-3
running-config
copy 5-11, 13-2, 13-4
show 12-1
S
saving configuration 4-1
self-protection command 12-33
service
adding 7-8
command 2-15, 2-16, 3-2
copy 8-16
deleting 7-9
MDM 2-16
permissions 3-3
snmp-trap 3-26
wbm 2-15
services
enabling 3-2
session, configuring timeout 3-33
session, displaying idle timeout 3-33
session timeout, disabling 3-33
session-timeout command 3-33
set-action 7-20
show commands
counters 12-3
cpu 12-24
diagnostic-info 12-21
disk-usage 12-23
drop-statistics 14-5
dynamic-filters 6-19, 14-3
file-servers 13-2, 13-6
flex-content-filter 6-9
host-keys 3-21
learning-params 7-15
log 12-8
log export-ip 12-7
logging 12-7
login-banner 3-30
memory 12-24
packet-dump 12-11
packet-dump signatures 12-19
policies 7-21, 14-2, 14-3
policies statistics 7-22, 8-8
public-key 3-25
rates 12-3, 14-1
recommendations 10-4
recommendations pending-filters 10-3, 10-5
reports 14-4
reports details 11-8
running-config 12-1
show 12-3
sorting dynamic-filters 6-19
sync-config file-servers 13-6
templates 5-4
zone policies 7-21
show privilege level 2-2, 3-7
show public-key command 3-25
shutdown command 2-9
signature
generating 12-18
SIP
detected anomalies 11-3
drop statistics 14-7
malformed packets 11-7
policy template 7-3
spoofed attacks 11-5
user filter action 6-14
snapshot
backing up policies 7-24, 8-17
command 8-13
comparing 8-14
deleting 8-16
displaying 8-15
save periodically 8-9
saving 8-13
snapshot command 8-12
SNMP
accessing 3-2
configuring trap generator 3-26
traps description 3-27
snmp commands
community 3-29
trap-dest 3-26
source IP
tunnel 2-11
specific IP threshold 7-17
speed command 2-8
spoofed attacks 1-2, 11-4, 11-9
src traffic characteristics 7-12
SSH
configuring 2-17
deleting keys 3-24
generating key 3-25
service 2-17
state command 7-13, 14-3
static route
adding 2-13
strong
dynamic filter action 6-18
policy action 7-19
protection level 1-5, 7-10
user filter action 6-14
sub zone 9-7
subzone
displaying logs and attack reports 9-8
syn_by_fin packet type 7-11
syns packet type 7-11
syslog
configuring export parameters 12-6
configuring server 12-7
message format 12-6
system log
message format 12-6
T
TACACS+
authentication
key generate command 3-19, 3-21
clearing statistics 3-17
configuring server 3-14
server connection timeout 3-16
server encryption key 3-15
server IP address 3-15
viewing statistics 3-17
tacacs-server commands
clear statistics 3-17
first-hit 3-14
host 3-14, 3-15
key 3-14, 3-15
show statistics 3-17
timeout 3-14, 3-16
TCP
detected anomalies 11-3
drop statistics 14-6, 14-7
no proxy policy templates 7-4
policy templates 7-2
templates
LINK 8-4
viewing policies 5-4
zone 5-2
thresh-mult 7-16, 14-2, 14-3
threshold
command 7-14
configuring IP threshold 7-17
configuring list 7-17
configuring specific IP 7-17
filter rate termination 6-23
malicious rate termination 6-23
marking as tuned 5-8, 8-10
multiplying 14-2, 14-3
multiplying before accepting 7-15
selection 8-13
setting as fixed 7-14
tuning 1-4, 8-2
threshold-list command 7-17
threshold selection 8-7
threshold tuning
save results periodically 8-9
time, configuring 3-21
timeout command 7-18
timeout session, configuring 3-33
timeout session, disabling 3-33
timesaver
symbol overview 1-xix
timezone 3-22
tip
symbol overview 1-xix
to-user-filters
dynamic filter action 6-18
policy action 7-19
traceroute command 12-29
traffic
monitoring 12-14, 12-15
traffic forwarding 4-6, A-6
traffic injection A-14
trap 12-6
trap-dest 3-26
tuning policy thresholds 8-6
tunnel
commands 2-11
configuring 2-10
GRE keepalive 2-11
tunnel diversion 4-20, A-11
Cisco router configuration 4-21
Guard configuration 4-21
U
UDP
detected anomalies 11-3
drop statistics 14-6
policy templates 7-3
unauthenticated drop statistics 14-6
unauth_pkts packet type 7-11
unauthenticated TCP detected anomalies 11-3
upgrading 13-8
MP 13-8
user
detected anomalies 11-3
user defined mitigated attacks 11-6
user filter
actions 6-13, 6-14, 6-18
command 6-4, 6-15
configuring 6-13
definition 1-5, 6-1
deleting 6-18
displaying 6-17
renumbering 6-15
username
encrypted password 3-7
username command 3-6
users
adding 3-6
adding new 3-6
assigning privilege levels 3-6
deleting 3-8
privilege levels 2-1, 3-9
system users
admin 2-7
riverhead 2-7
username command 3-6
V
VLAN
configuring 2-9
VLAN VPN routing forwarding 4-17
VLAN VRF A-10
Voice over IP
See VoIP
VoIP
detected anomalies 11-3
drop statistics 14-7
malformed packets 11-7
policy template 7-3
spoofed attacks 11-5
user filter action 6-14
zone template 5-3
VPN routing forwarding 4-11, A-6
VRF A-6, A-8
VRF-DST
Cisco router configuration 4-13
Guard configuration 4-12
VRF - VLAN 4-17
W
WBM
activating 2-15
WBM logo
adding 3-31
deleting 3-32
X
XML schema11-12to 11-14, 13-6
Z
zebra routing table B-3
zombie 11-9
packet counter 12-4
zombie attack 11-10
zombies 1-3
zone
blocking criteria 14-3
blocking flows 14-2
clearing counters 12-4
command 5-4, 5-5, 10-3
command completion 3-13, 5-6
comparing 8-14
configuration mode 2-3, 5-5
copying 5-5
creating 5-4
creating default 9-6
defining IP address 5-7
definition 5-1
deleting 5-4
deleting IP address 5-8
duplicating 5-5
excluding IP address 5-7
IP address 5-7
learning 8-1
LINK templates 8-4
malicious rate 9-8
modifying IP address 5-8
operation mode 5-4
protecting 9-1
reconfiguring 5-5
sub 9-7
synchronize configuration 5-8
synchronizing offline 5-10
templates 5-2
viewing configuration 5-7
viewing policies 7-21
viewing status 12-2
zone-malicious-rate 6-23
zone policy
marking as tuned 5-8, 8-10
zone protection
terminating 9-11
zone synchronization 8-3