- Table of Contents
-
- 09-Configuration Examples
- 01-Web Login Configuration Examples
- 02-Internet Access Through a Static IP Address Configuration Examples
- 03-Internet access through PPPoE configuration examples
- 04-License Configuration Examples
- 05-Signature Library Upgrade Configuration Examples
- 06-Software Upgrade Examples
- 06-Software Upgrade Examples (only for F50X0-D and F5000-AK5X5 firewalls)
- 07-Routing deployment configuration examples
- 08-Transparent deployment configuration examples
- 09-Static routing configuration examples
- 10-RIP configuration examples
- 11-OSPF configuration examples
- 12-BGP configuration examples
- 13-Policy-based routing configuration examples
- 14-Security Policy Configuration Examples
- 15-APR-Based Security Policy Configuration Examples
- 16-Object Group Configuration Examples
- 17-User identification configuration examples
- 18-Attack defense configuration examples
- 19-IPCAR Configuration Examples
- 20-IPS Configuration Examples
- 21-URL Filtering Configuration Examples
- 22-Anti-Virus Configuration Examples
- 23-File Filtering Configuration Examples
- 24-Data Filtering Configuration Examples
- 25-WAF Configuration Examples
- 26-IP Reputation Configuration Examples
- 27-APT Defense Configuration Examples
- 28-NetShare Control Configuration Examples
- 29-Bandwidth Management Configuration Examples
- 30-IPsec configuration examples
- 31-SSL VPN IP access configuration examples
- 31-SSL VPN TCP access configuration examples
- 31-SSL VPN Web access configuration examples
- 32-L2TP Configuration Examples
- 33-NAT configuration examples
- 34-NPTv6 Configuration Examples
- 35-Policy-based NAT configuration examples
- 36-NAT hairpin configuration examples
- 37-NAT Flow Logging Configuration Examples
- 38-Inbound Link Load Balancing Configuration Examples
- 39-Outbound Link Load Balancing Configuration Examples
- 40-Server Load Balancing Configuration Examples
- 41-Transparent DNS Proxy Configuration Examples
- 42-High Availability Group Configuration Examples
- 43-Context Configuration Examples
- 43-Context Configuration Examples(only for F50X0-D and F5000-AK5X5 firewalls)
- 44-IRF configuration examples
- 44-IRF configuration examples(only for F50X0-D and F5000-AK5X5 firewalls)
- 45-DHCP configuration examples
- 46-DNS configuration examples
- 47-Server Connection Detection Configuration Examples
- 48-Connection Limit Configuration Examples
- 49-Public key management configuration examples
- 50-SSL Decryption Configuration Examples
- 51-MAC Address Learning Through a Layer 3 Device Configuration Examples
- 52-4G Configuration Examples
- 53-WLAN Configuration Examples
- Related Documents
-
Title | Size | Download |
---|---|---|
19-IPCAR Configuration Examples | 78.79 KB |
Contents
· Example: Configuring IPCAR for public network protection
· Example: Configuring IPCAR for internal network protection
The following information provides IPCAR configuration examples.
IPCAR can limit the new connection establishment rate on the device. It can be used to prevent DDoS attacks from decreasing the device performance.
The device can use IPCAR to protect the public network or internal network:
· Public network protection—Limits the rate of connection establishment requests from the public network to the internal network. The device monitors the number of connection establishment requests based on the destination IP address of packets. If the number reaches the connection rate threshold, the device will take the specified action on subsequent packets.
· Internal network protection—Limits the rate of connection establishment requests from the internal network to the public network. The device monitors the number of connection establishment requests based on the source IP address of packets. If the number reaches the connection rate threshold, the device will take the specified action on subsequent packets.
This document is not restricted to specific software or hardware versions. Procedures and information in the examples might be slightly different depending on the software or hardware version of the device.
The configuration examples were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.
The following information is provided based on the assumption that you have basic knowledge of the IP CAR feature.
Network configuration
As shown in Figure 1, configure IPCAR for public network protection on the device to limit the rate to 10 for connection requests from the public network to each internal server.
Software versions used
This configuration example was created and verified on the R8860 of the F1000-AI-55 device.
Procedure
Assigning IP addresses to interfaces and adding the interfaces to security zones
# On the top navigation bar, click Network.
# From the navigation pane, select Interface Configuration > Interfaces.
# Click the Edit icon for GE 1/0/1.
# In the dialog box that opens, configure the interface:
1. Select the Trust security zone.
2. Click the IPv4 Address tab, and then enter the IP address and mask of the interface. In this example, enter 10.0.0.1/24.
3. Use the default settings for other parameters.
4. Click OK.
# Add GE 1/0/2 to the Trust security zone and set its IP address to 192.168.1.1/24 in the same way you configure GE 1/0/1.
Configuring a security policy
# On the top navigation bar, click Policies.
# From the navigation pane, select Security Policies > Security Policies.
# Click Create > Create a policy.
# Configure security policy Secpolicy:
· Enter security policy name trust-local.
· Select source security zone Untrust.
· Select destination security zone Trust.
· Select type IPv4.
· Select action Permit.
· Set destination IPv4 addresses to 192.168.1.10, 192.168.1.11, and 192.168.1.12.
· Use the default settings for other parameters.
# Click OK.
Configuring IPCAR
# On the top navigation bar, click Policies.
# From the navigation pane, select Attack Defense > IPCAR.
# Configure the following IPCAR parameters:
· Select IP type IPv4.
· Select action Packet dropping.
· Select public network interface GE1/0/1.
· Set the connection rate threshold to 10.
Figure 2 Configuring IPCAR
Verifying the configuration
# Verify that each internal server can receive a maximum of 10 connection requests from the external network.
Network configuration
As shown in Figure 3, configure IPCAR for internal network protection on the device to limit the rate to 10 for connection requests initiated from each internal server to the public network.
Software versions used
This configuration example was created and verified on the R8860 of the F1000-AI-55 device.
Procedure
Assigning IP addresses to interfaces and adding the interfaces to security zones
# On the top navigation bar, click Network.
# From the navigation pane, select Interface Configuration > Interfaces.
# Click the Edit icon for GE 1/0/1.
# In the dialog box that opens, configure the interface:
1. Select the Trust security zone.
2. Click the IPv4 Address tab, and then enter the IP address and mask of the interface. In this example, enter 10.0.0.1/24.
3. Use the default settings for other parameters.
4. Click OK.
# Add GE 1/0/2 to the Trust security zone and set its IP address to 192.168.1.1/24 in the same way you configure GE 1/0/1.
Configuring a security policy
# On the top navigation bar, click Policies.
# From the navigation pane, select Security Policies > Security Policies.
# Click Create > Create a policy.
# Configure security policy Secpolicy:
· Enter security policy name trust-local.
· Select source security zone Untrust.
· Select destination security zone Trust.
· Select type IPv4.
· Select action Permit.
· Set destination IPv4 addresses to 192.168.1.10, 192.168.1.11, and 192.168.1.12.
· Use the default settings for other parameters.
# Click OK.
Configuring IPCAR
# On the top navigation bar, click Policies.
# From the navigation pane, select Attack Defense > IPCAR.
# Click the Internal Network Protection tab.
# Configure the following IPCAR parameters:
· Select IP type IPv4.
· Select action Packet dropping.
· Select internal network interface GE1/0/2.
· Set the connection rate threshold to 10.
Figure 4 Configuring IPCAR
Verifying the configuration
# Verify that each internal server can initiate a maximum of 10 connections to the external network.