agentleFS
Sign inStart free
nanxiaoyaonanxiaoyao/network-huawei-skills/attack-defense/SKILL.md

attack-defense

Skill2 starsChanged 3 months agoMITView on GitHub

This skill should be used when the user asks to configure or troubleshoot Huawei USG6000E firewall attack defense features. Covers Anti-DDoS (SYN/UDP/HTTP flood), single-packet attack defense, URPF source-address validation, per-IP connection rate limiting, traffic-based dynamic CAR, and SACG admission control linkage. Applicable platforms USG6000E V600R007C20+ and USG6000/USG9500/NGFW Module V500R005C20+ (CLI syntax identical between versions).

The file

Create a free account to mount
Files
SKILL.md

华为 USG 攻击防范配置技能 (attack-defense)

适用平台 USG6000E 系列 适用版本 V600R007C20+ 文档来源 HUAWEI USG6000E V600R007C20 产品文档 (案例 sec_case_defend_*)

USG 攻击防范分三层 单包攻击防范（畸形/扫描类）+ 流量型攻击防范（DDoS）+ 应用层攻击防范（HTTP/DNS Flood）

触发场景

  • 公网链路被刷流量 怀疑 DDoS
  • 服务器 syn-flood / udp-flood 攻击
  • 应用层 HTTP-flood CC 攻击
  • 配置源地址校验 防 IP 欺骗
  • 限制单 IP 新建连接数 防爬虫/扫描
  • 联动 IDS/HiSec Insight 做高级威胁防御
  • 终端准入 SACG 联动

防护体系全景

┌───────────────────────────────────────────────────┐
│ 应用层  HTTP-Flood / DNS-Flood / SIP-Flood        │
│  ├─ 指纹学习  dynamic-fingerprint-learn          │
│  └─ 源认证    source-detect                       │
├───────────────────────────────────────────────────┤
│ 流量层  SYN/UDP/ICMP Flood + 动态限流             │
│  ├─ alert-rate 阈值告警                           │
│  ├─ defend 启用清洗                               │
│  └─ auto-defend 动态 CAR                          │
├───────────────────────────────────────────────────┤
│ 单包层  畸形包 IP/TCP options 扫描                │
│  └─ firewall defend XXX enable                    │
├───────────────────────────────────────────────────┤
│ 入口层  URPF 反向路径校验 防 IP 欺骗              │
└───────────────────────────────────────────────────┘

一 Anti-DDoS 防 DDoS

配置三步走

  1. 接口启用流量统计 anti-ddos flow-statistic enable
  2. 启用基线学习 自适应阈值 anti-ddos baseline-learn start
  3. 配置各攻击类型 alert/defend

经典模板 来自 sec_case_defend_0005

system-view
interface GigabitEthernet 0/0/1
 anti-ddos flow-statistic enable
 quit
anti-ddos syn-flood source-detect
anti-ddos syn-flood defend alert-rate 3000
anti-ddos udp-flood dynamic-fingerprint-learn alert-speed 80
anti-ddos udp-frag-flood dynamic-fingerprint-learn alert-speed 50
anti-ddos http-flood defend alert-rate 9000
anti-ddos http-flood source-detect mode basic
anti-ddos baseline-learn tolerance-value 100
anti-ddos baseline-learn start

阈值原则

  • 业务峰值 ×3 作为 alert-rate
  • 先观察 1-2 周 学习基线 再开 defend
  • tolerance-value 100 表示允许超基线 100%

二 单包攻击防范

适用：畸形包 land smurf fraggle teardrop 端口扫描 IP-Sweep TCP options

firewall defend land enable
firewall defend smurf enable
firewall defend fraggle enable
firewall defend tcp-flag enable
firewall defend ip-fragment enable
firewall defend ip-spoofing enable
firewall defend route-record enable
firewall defend source-route enable
firewall defend ip-sweep enable
 firewall defend ip-sweep max-rate 5000 blacklist-timeout 20
firewall defend port-scan enable
 firewall defend port-scan max-rate 4000 blacklist-timeout 20

三 URPF 反向路径校验

防伪源地址 防地址欺骗 IP-spoofing

IPv4

interface GigabitEthernet 0/0/1
 ip urpf { strict | loose } [ allow-default-route ] [ acl <num> ]

IPv6

interface GigabitEthernet 0/0/1
 ipv6 enable
 ipv6 address 2002::2 64
 ipv6 urpf { strict | loose } [ allow-default-route ] [ acl6 <num> ]

模式选择：

  • strict 严格 入接口必须是该源地址回包的最优出接口（适合 ISP 边界）
  • loose 宽松 路由表里有该源即可（适合不对称路由场景）

四 流量型攻击动态限流 auto-defend CAR

适用：检测到攻击源后 自动对其限速 不影响整体业务

anti-ddos auto-defend traffic-policy enable
anti-ddos auto-defend car 50000               # 限速值 单位 bps
anti-ddos auto-defend base-session enable     # 启用会话基线
anti-ddos auto-defend base-session alert-rate 100000 max-rate 200000

五 每 IP 新建连接限速

防爬虫 慢速扫描

firewall statistic system enable
ip-link check enable
firewall session aging-time service-set <service> <s>

# 创建限速对象
firewall ip-link 1 destination <ip>
# 或基于策略限速
security-policy
 rule name limit_per_source
  source-zone untrust
  destination-zone trust
  action permit
  session aging-time 60

更细粒度：

firewall session link-state check
firewall defend connection-limit enable
firewall defend connection-limit max-num <num>

六 SACG 终端准入联动

USG 作为安全接入控制网关 联动 Agile Controller 做终端合规

旁挂模式（sec_case_defend_0022）：

right-manager server-group
 server authentication 10.1.1.1 1645 shared-key cipher Admin@123
 server authentication source ip 192.168.10.1
 default authentication policy permit
right-manager
 firewall id 5

直路模式（sec_case_defend_0023）：在所有终端流量必经接口启用

七 查看与诊断

命令说明
display anti-ddos statistics总览攻击统计
display anti-ddos baseline-learn information基线学习状态
display anti-ddos syn-flood defendSYN flood 防御状态
display anti-ddos http-flood defendHTTP flood 防御
display anti-ddos abnormal source-ip异常源 IP 列表
display firewall blacklist item黑名单
display firewall statistic system系统级会话/速率统计
display ip urpfURPF 状态
display firewall defend flag单包防御开启情况

八 常见陷阱

  • 没启 anti-ddos flow-statistic enable 就开防御 → 看不到攻击源
  • alert-rate 设太低 → 误杀正常业务 必须先学基线
  • URPF strict 用在不对称路由 → 合法流量被丢
  • HTTP-flood source-detect basic 在 CDN/反向代理后 → 把代理 IP 当攻击源 用 advanced 模式
  • 黑名单超时 blacklist-timeout 设太长 → 误判恢复慢 建议先 30s

相关文件

  • references/defend-commands.md 完整命令速查
  • references/defend-troubleshooting.md 防御误判与调优

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free