本举例是在M9000-AI-E8的R9071版本上进行配置和验证的。
如下图所示，在Device上配置HTTP客户端验证功能，保护内网服务器不会受到外网非法用户的HTTP flood攻击。
图-1 安全域上的HTTP客户端验证配置组网图
配置接口IP地址
# 根据组网图中规划的信息，配置各接口的IP地址，具体配置步骤如下。
<Device> system-view
[Device] interface gigabitethernet 1/0/1
[Device-GigabitEthernet1/0/1] ip address 192.168.1.1 255.255.255.0
[Device-GigabitEthernet1/0/1] quit
请参考以上步骤配置其他接口的IP地址，具体配置步骤略。
将接口加入安全域
# 请根据组网图中规划的信息，将接口加入对应的安全域，具体配置步骤如下。
[Device] security-zone name trust
[Device-security-zone-Trust] import interface gigabitethernet 1/0/1
[Device-security-zone-Trust] quit
[Device] security-zone name untrust
[Device-security-zone-Untrust] import interface gigabitethernet 1/0/2
[Device-security-zone-Untrust] quit
配置安全策略
# 配置名称为untrust-trust的安全策略，保证Internet中的主机可以访问内网服务器，具体配置步骤如下。
[Device] security-policy ip
[Device-security-policy-ip] rule name untrust-trust
[Device-security-policy-ip-1-untrust-trust] source-zone untrust
[Device-security-policy-ip-1-untrust-trust] destination-zone trust
[Device-security-policy-ip-1-untrust-trust] destination-ip-host 192.168.1.10
[Device-security-policy-ip-1-untrust-trust] destination-ip-host 192.168.1.11
[Device-security-policy-ip-1-untrust-trust] destination-ip-host 192.168.1.12
[Device-security-policy-ip-1-untrust-trust] action pass
[Device-security-policy-ip-1-untrust-trust] quit
[Device-security-policy-ip] quit
配置HTTP客户端验证功能
# 创建攻击防范策略a1。
[Device] attack-defense policy a1
# 对所有非受保护IP地址开启HTTP flood攻击防范检测。
[Device-attack-defense-policy-a1] http-flood detect non-specific
# 配置HTTP flood攻击防范的全局触发阈值为10000。
[Device-attack-defense-policy-a1] http-flood threshold 10000
# 配置HTTP flood攻击防范的全局处理行为添加到HTTP客户端验证的受保护IP列表中以及输出告警日志。
[Device-attack-defense-policy-a1] http-flood action logging client-verify
[Device-attack-defense-policy-a1] quit
# 在安全域Untrust上应用攻击防范策略a1。
[Device] security-zone name untrust
[Device-security-zone-Untrust] attack-defense apply policy a1
# 在安全域Untrust上开启HTTP客户端验证功能。
[Device-security-zone-Untrust] client-verify http enable
[Device-security-zone-Untrust] quit
# 以上配置完成之后，若有针对服务器的HTTP flood攻击发生时，可以通过display client-verify http protected ip命令查看受攻击的服务器的IP地址被添加为动态受保护IP。
[Device] display client-verify http protected ip
IP address VPN instance Port Type Requested Trusted
192.168.1.10 -- 8080 Dynamic 20 12。
#
interface GigabitEthernet1/0/1
port link-mode route
ip address 192.168.1.1 255.255.0.0
#
interface GigabitEthernet1/0/2
port link-mode route
ip address 10.0.0.1 255.255.0.0
#
security-zone name Trust
import interface GigabitEthernet1/0/1
#
security-zone name Untrust
import interface GigabitEthernet1/0/2
attack-defense apply policy a1
client-verify http enable
#
attack-defense policy a1
http-flood detect non-specific
http-flood action logging client-verify
#
security-policy ip
rule 1 name untrust-trust
action pass
source-zone untrust
destination-zone trust
destination-ip-host 192.168.1.10
destination-ip-host 192.168.1.11
destination-ip-host 192.168.1.12