agentsclimarketplace
Sign in

Attack defense

Skill nanxiaoyao/network-huawei-skills/attack-defense

This skill should be used when the user asks to configure or troubleshoot Huawei USG6000E firewall attack defense features. Covers Anti-DDoS (SYN/UDP/HTTP flood), single-packet attack defense, URPF source-address validation, per-IP connection rate limiting, traffic-based dynamic CAR, and SACG admission control linkage. Applicable platforms USG6000E V600R007C20+ and USG6000/USG9500/NGFW Module V500R005C20+ (CLI syntax identical between versions).From its SKILL.md

Install
npx -y skills add nanxiaoyao/network-huawei-skills --skill attack-defense

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

6.9 KB, ~2.0k tokens by cl100k_base, as published. Nobody here has run it

华为 USG 攻击防范配置技能 (attack-defense)

适用平台 USG6000E 系列 适用版本 V600R007C20+ 文档来源 HUAWEI USG6000E V600R007C20 产品文档 (案例 sec_case_defend_*)

USG 攻击防范分三层 单包攻击防范（畸形/扫描类）+ 流量型攻击防范（DDoS）+ 应用层攻击防范（HTTP/DNS Flood）

触发场景

  • 公网链路被刷流量 怀疑 DDoS
  • 服务器 syn-flood / udp-flood 攻击
  • 应用层 HTTP-flood CC 攻击
  • 配置源地址校验 防 IP 欺骗
  • 限制单 IP 新建连接数 防爬虫/扫描
  • 联动 IDS/HiSec Insight 做高级威胁防御
  • 终端准入 SACG 联动

防护体系全景

┌───────────────────────────────────────────────────┐
│ 应用层  HTTP-Flood / DNS-Flood / SIP-Flood        │
│  ├─ 指纹学习  dynamic-fingerprint-learn          │
│  └─ 源认证    source-detect                       │
├───────────────────────────────────────────────────┤
│ 流量层  SYN/UDP/ICMP Flood + 动态限流             │
│  ├─ alert-rate 阈值告警                           │
│  ├─ defend 启用清洗                               │
│  └─ auto-defend 动态 CAR                          │
├───────────────────────────────────────────────────┤
│ 单包层  畸形包 IP/TCP options 扫描                │
│  └─ firewall defend XXX enable                    │
├───────────────────────────────────────────────────┤
│ 入口层  URPF 反向路径校验 防 IP 欺骗              │
└───────────────────────────────────────────────────┘

一 Anti-DDoS 防 DDoS

配置三步走

  1. 接口启用流量统计 anti-ddos flow-statistic enable
  2. 启用基线学习 自适应阈值 anti-ddos baseline-learn start
  3. 配置各攻击类型 alert/defend

经典模板 来自 sec_case_defend_0005

system-view
interface GigabitEthernet 0/0/1
 anti-ddos flow-statistic enable
 quit
anti-ddos syn-flood source-detect
anti-ddos syn-flood defend alert-rate 3000
anti-ddos udp-flood dynamic-fingerprint-learn alert-speed 80
anti-ddos udp-frag-flood dynamic-fingerprint-learn alert-speed 50
anti-ddos http-flood defend alert-rate 9000
anti-ddos http-flood source-detect mode basic
anti-ddos baseline-learn tolerance-value 100
anti-ddos baseline-learn start

阈值原则

  • 业务峰值 ×3 作为 alert-rate
  • 先观察 1-2 周 学习基线 再开 defend
  • tolerance-value 100 表示允许超基线 100%

二 单包攻击防范

适用：畸形包 land smurf fraggle teardrop 端口扫描 IP-Sweep TCP options

firewall defend land enable
firewall defend smurf enable
firewall defend fraggle enable
firewall defend tcp-flag enable
firewall defend ip-fragment enable
firewall defend ip-spoofing enable
firewall defend route-record enable
firewall defend source-route enable
firewall defend ip-sweep enable
 firewall defend ip-sweep max-rate 5000 blacklist-timeout 20
firewall defend port-scan enable
 firewall defend port-scan max-rate 4000 blacklist-timeout 20

三 URPF 反向路径校验

防伪源地址 防地址欺骗 IP-spoofing

IPv4

interface GigabitEthernet 0/0/1
 ip urpf { strict | loose } [ allow-default-route ] [ acl <num> ]

IPv6

interface GigabitEthernet 0/0/1
 ipv6 enable
 ipv6 address 2002::2 64
 ipv6 urpf { strict | loose } [ allow-default-route ] [ acl6 <num> ]

模式选择：

  • strict 严格 入接口必须是该源地址回包的最优出接口（适合 ISP 边界）
  • loose 宽松 路由表里有该源即可（适合不对称路由场景）

四 流量型攻击动态限流 auto-defend CAR

适用：检测到攻击源后 自动对其限速 不影响整体业务

anti-ddos auto-defend traffic-policy enable
anti-ddos auto-defend car 50000               # 限速值 单位 bps
anti-ddos auto-defend base-session enable     # 启用会话基线
anti-ddos auto-defend base-session alert-rate 100000 max-rate 200000

五 每 IP 新建连接限速

防爬虫 慢速扫描

firewall statistic system enable
ip-link check enable
firewall session aging-time service-set <service> <s>

# 创建限速对象
firewall ip-link 1 destination <ip>
# 或基于策略限速
security-policy
 rule name limit_per_source
  source-zone untrust
  destination-zone trust
  action permit
  session aging-time 60

更细粒度：

firewall session link-state check
firewall defend connection-limit enable
firewall defend connection-limit max-num <num>

六 SACG 终端准入联动

USG 作为安全接入控制网关 联动 Agile Controller 做终端合规

旁挂模式（sec_case_defend_0022）：

right-manager server-group
 server authentication 10.1.1.1 1645 shared-key cipher Admin@123
 server authentication source ip 192.168.10.1
 default authentication policy permit
right-manager
 firewall id 5

直路模式（sec_case_defend_0023）：在所有终端流量必经接口启用

七 查看与诊断

命令说明
display anti-ddos statistics总览攻击统计
display anti-ddos baseline-learn information基线学习状态
display anti-ddos syn-flood defendSYN flood 防御状态
display anti-ddos http-flood defendHTTP flood 防御
display anti-ddos abnormal source-ip异常源 IP 列表
display firewall blacklist item黑名单
display firewall statistic system系统级会话/速率统计
display ip urpfURPF 状态
display firewall defend flag单包防御开启情况

八 常见陷阱

  • 没启 anti-ddos flow-statistic enable 就开防御 → 看不到攻击源
  • alert-rate 设太低 → 误杀正常业务 必须先学基线
  • URPF strict 用在不对称路由 → 合法流量被丢
  • HTTP-flood source-detect basic 在 CDN/反向代理后 → 把代理 IP 当攻击源 用 advanced 模式
  • 黑名单超时 blacklist-timeout 设太长 → 误判恢复慢 建议先 30s

相关文件

  • references/defend-commands.md 完整命令速查
  • references/defend-troubleshooting.md 防御误判与调优

What ships with it: 2 files

8.7 KB alongside SKILL.md

references/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.