Contents

IP reputation commands· 1

attack-category· 1

display ip-reputation· 2

display ip-reputation attack-category· 3

display ip-reputation exception· 4

display ip-reputation signature library· 5

display ip-reputation top-hit-statistics· 6

exception· 7

global enable· 8

ip-reputation· 8

ip-reputation signature auto-update· 9

ip-reputation signature auto-update-now· 9

ip-reputation signature rollback· 10

ip-reputation signature update· 10

top-hit-statistics enable· 13

update schedule· 14

 

IP reputation commands

The following compatibility matrix shows the support of hardware platforms for IP reputation:

‌

Hardware platform	Module type	IP reputation compatibility
M9006 M9010 M9014	Blade IV firewall module	Yes
	Blade V firewall module	Yes
	NAT module	No
M9010-GM	Encryption module	Yes
M9016-V	Blade V firewall module	Yes
M9008-S M9012-S	Blade IV firewall module	Yes
	Intrusion prevention service (IPS) module	Yes
	Video network gateway module	Yes
M9008-S-V	Blade IV firewall module	Yes
M9000-AI-E4 M9000-AI-E8 M9000-AI-E16	Blade V firewall module	Yes
M9000-AK001	Blade V firewall module	Yes
M9000-X06 M9000-X06-B M9000-X06-B-G M9000-X06-G M9000-X10	Blade VI firewall module	Yes
M9000-AI-X06 M9000-AI-X10	Blade VI firewall module	Yes

‌

attack-category

Use attack-category to configure actions for an attack category.

Use undo attack-category to restore the default.

Syntax

attack-category attack-id { action { deny | permit } | logging { disable | enable } }*

undo attack-category attack-id

Default

No actions are configured for an attack category. Each attack category has its own pre-defined actions.

Views

IP reputation view

Predefined user roles

network-admin

context-admin

Parameters

attack-id: Specifies an attack category ID. The value range depends on the IP reputation file and the device model.

action: Specifies an action.

deny: Drops matching packets.

permit: Allows matching packets to pass through.

logging: Sets the logging status for the attack category. When a packet matches the attack category with logging enabled, the device generates logs for the matching events.

disable: Disables logging for the matching events.

enable: Enables logging for the matching events.

Usage guidelines

The command configuration takes effect after you enable IP reputation.

On the IP reputation list, an IP address can belong to multiple attack categories. Each attack category has its own actions.

If an IP address belongs to only one attack category, the device takes the actions in this attack category. If an IP address belongs to multiple attack categories, the device takes an action that has higher priority among all actions in those attack categories. The drop action has higher priority than the permit action.

If logging is enabled for any one of attack categories to which an IP address belongs, the device generates a log when the IP address is matched.

The device supports fast output of IP reputation logs. For more information about fast log output, see fast log output commands in Network Management and Monitoring Command Reference.

Examples

# Set the action to deny for attack category 1 and enable logging for the attack category.

<Sysname> system-view

[Sysname] ip-reputation

[Sysname-ip-reputation] attack-category 1 action deny logging enable

Related commands

display ip-reputation attack-category

global enable

display ip-reputation

Use display ip-reputation to display IP reputation information about an IP address.

Syntax

display ip-reputation ipv4 ipv4-address

Views

Any view

Predefined user roles

network-admin

network-operator

context-admin

context-operator

Parameters

ipv4 ipv4-address: Specifies an IPv4 address.

Usage guidelines

The IP reputation list contains the following attribute information for an IP address: attack category, match field, actions on matching packets, and the hit count.

If an IP address belongs to multiple attack categories, the command displays information about the IP address based on the attack category ID.

Examples

# Display IP reputation information about IP address 192.168.1.1.

<Sysname> display ip-reputation ipv4 192.168.1.1

IP address    Attack ID    Attack name    Direction    Action    Logging    Hit count

192.168.1.1   1             ddos             src           deny      enabled    1000

                2             web              dst           permit    disabled

Figure 1 Command output

Field	Description
IP address	IP address on the IP reputation list.
Attack ID	ID of the attack category to which the IP address belongs.
Attack name	Name of the attack category to which the IP address belongs.
Direction	Match field attribute of the IP address: ·     src—Used as the source IP address match criterion. ·     dst—Used as the destination IP address match criterion. ·     src/dst—Used as the source or destination IP address match criterion.
Action	Action on matching packets: ·     permit—Allows the packets to pass through. ·     deny—Drops the packets.
Logging	Logging status, enabled or disabled.
Hit count	Number of times that the IP address is matched.

 

display ip-reputation attack-category

Use display ip-reputation attack-category to display information about attack categories for IP reputation.

Syntax

display ip-reputation attack-category

Views

Any view

Predefined user roles

network-admin

network-operator

context-admin

context-operator

Usage guidelines

The command displays attack category information after IP reputation is enabled.

If you do not specify actions for an attack category, the pre-defined actions are displayed.

Examples

# Display information about attack categories for IP reputation.

<Sysname> display ip-reputation attack-category

ID      Attack name      Action      Logging

1       ddos              permit      enabled

2       web               deny         disabled

Figure 2 Command output

Field	Description
ID	Attack category ID.
Attack name	Attack category name.
Action	Action that the device takes on packets matching the attack category. ·     permit—Forwards the packets. ·     deny—Discards the packets.
Logging	Logging status, enabled or disabled.

 

Related commands

attack-category

display ip-reputation exception

Use display ip-reputation exception to display exception IP addresses.

Syntax

display ip-reputation exception

Views

Any view

Predefined user roles

network-admin

network-operator

context-admin

context-operator

Usage guidelines

The command displays exception IP addresses, if any, when the IP reputation is enabled.

Examples

# Display exception IP addresses.

<Sysname> display ip-reputation exception

IP address

10.1.1.1

10.10.1.1

Figure 3 Command output

Field	Description
IP address	Exception IP address.

 

display ip-reputation signature library

Use display ip-reputation signature library to display information about the IP reputation signature library.

Syntax

display ip-reputation signature library

Views

Any view

Predefined user roles

network-admin

network-operator

context-admin

context-operator

Examples

# Display information about the IP reputation signature library.

<Sysname> display ip-reputation signature library

iP-reputation signature library information:

Type     SigVersion        ReleaseTime                    Size

Current  1.02               Fri Sep 13 09:05:35 2014    71594

Last      -                   -                               -

Factory  -                   -                                -

Table 1 Command output

Field	Description
Type	Version type of the IP reputation signature library. ·     Current—Current version. ·     Last—Previous version. ·     Factory—Factory default version. (Not supported currently.)
SigVersion	Version number of the IP reputation signature library.
ReleaseTime	Release time of the IP reputation signature library.
Size(bytes)	Size of the IP reputation signature library file, in bytes.

‌

display ip-reputation top-hit-statistics

Use display ip-reputation top-hit-statistics to display statistics for IP addresses with the highest hits on the IP reputation list.

Syntax

In standalone mode:

display ip-reputation top-hit-statistics [ top-number ] [ slot slot-number ]

In IRF mode:

display ip-reputation top-hit-statistics [ top-number ] [ chassis chassis-number slot slot-number [ cpu cpu-number ] ]

Views

Any view

Predefined user roles

network-admin

network-operator

context-admin

context-operator

Parameters

top-number: Specifies the number of top ranking IP addresses. The value range is 10 to 100, and the default is 10.

slot slot-number: Specifies a card by its slot number. If you do not specify a card, this command displays statistics for IP addresses with the highest hits on the IP reputation list for all cards. (In standalone mode.)

chassis chassis-number slot slot-number: Specifies a card on an IRF member device. The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. If you do not specify a card, this command displays statistics for IP addresses with the highest hits on the IP reputation list for all cards. (In IRF mode.)

cpu cpu-number: Specifies a CPU by its number. This option is available only if multiple CPUs are available on the specified slot. Support for this option depends on the device model.

Usage guidelines

This command displays statistics for IP addresses with the highest hits on the IP reputation list when the top hit ranking feature is enabled.

This command does not display IP addresses with no hits. Therefore, the number of IP addresses in the command output might be less than the value of the top-number argument.

Examples

# (In standalone mode.) Display statistics for 10 IP addresses with the highest hits on the IP reputation list.

<Sysname> display ip-reputation top-hit-statistics 10 slot 1

Slot 1:

IP address      Hit count

10.1.1.1        1000

10.1.1.2        999

10.1.1.3        996

10.1.1.4        994

10.1.1.5        994

10.1.1.6        994

Figure 4 Command output

Field	Description
IP address	IP address on the IP reputation list.
Hit count	Number of times that the IP address is hit.

 

exception

Use exception to specify an exception IP address.

Use undo exception to remove an exception IP address.

Syntax

exception ipv4 ipv4-address

undo exception ipv4 ipv4-address

Default

No exception IP address is specified.

Views

IP reputation view

Predefined user roles

network-admin

context-admin

Parameters

ipv4 ipv4-address: Specifies an exception IPv4 address.

Usage guidelines

The command takes effect after you enable IP reputation.

The device forwards a packet if the source or destination IP address of the packet is an exception IP address.

Repeat this command to add multiple exception IP addresses.

Examples

# Specify 192.168.1.1 as an exception IP address.

<Sysname> system-view

[Sysname] ip-reputation

[Sysname-ip-reputation] exception ipv4 192.168.1.1

Related commands

display ip-reputation exception

global enable

global enable

Use global enable to enable IP reputation globally.

Use undo global enable to disable IP reputation globally.

Syntax

global enable

undo global enable

Default

IP reputation is disabled globally.

Views

IP reputation view

Predefined user roles

network-admin

context-admin

Examples

# Enable IP reputation globally.

<Sysname> system-view

[Sysname] ip-reputation

[Sysname-ip-reputation] global enable

ip-reputation

Use ip-reputation to enter IP reputation view.

Use undo ip-reputation to delete all configuration in IP reputation view.

Syntax

ip-reputation

undo ip-reputation

Views

System view

Predefined user roles

network-admin

context-admin

Examples

# Enter IP reputation view.

<Sysname> system-view

[Sysname] ip-reputation

[Sysname-ip-reputation]

ip-reputation signature auto-update

Use ip-reputation signature auto-update to enable automatic update of the IP reputation signature library and enter automatic IP reputation signature library update configuration view.

Use undo ip-reputation signature auto-update to disable automatic update of the IP reputation signature library.

Syntax

ip-reputation signature auto-update

undo ip-reputation signature auto-update

Default

Automatic update of the IP reputation signature library is disabled.

Views

System view

Predefined user roles

network-admin

context-admin

Usage guidelines

After you enable automatic update of the IP reputation signature library, the device periodically accesses the signature database services on the official website to download the latest IP reputation signature library.

Examples

# Enable automatic update of the IP reputation signature library and enter automatic IP reputation signature library update configuration view.

<Sysname> system-view

[Sysname] ip-reputation signature auto-update

[Sysname-ip-reputation-autoupdate]

Related commands

update schedule

ip-reputation signature auto-update-now

Use ip-reputation signature auto-update-now to trigger an automatic update of the IP reputation signature library manually.

Syntax

ip-reputation signature auto-update-now

Views

System view

Predefined user roles

network-admin

context-admin

Usage guidelines

After you execute this command, the device immediately starts the automatic update process of the IP reputation signature library no matter whether or not automatic signature library update is enabled. Before overwriting the current signature library file, the device automatically backs it up to the ipreputation_sigpack_curr.dat file in the device storage medium.

You can execute this command anytime you find a new version of signature library on the official website.

Examples

# Trigger an automatic update of the IP reputation signature library manually.

<Sysname> system-view

[Sysname] ip-reputation signature auto-update-now

ip-reputation signature rollback

Use ip-reputation signature rollback to roll back the IP reputation signature library.

Syntax

ip-reputation signature rollback last

Views

System view

Predefined user roles

network-admin

context-admin

Parameters

last: Rolls back the IP reputation signature library to the previous version.

Usage guidelines

If an IP reputation signature library update causes exceptions or a high false alarm rate, you can roll back the IP reputation signature library.

Before performing an IP reputation signature library rollback, the device backs up the current IP reputation signature library as the previous version. For example, the previous library version is V1 and the current library version is V2. If you perform a rollback to the previous version, library version V1 becomes the current version and library version V2 becomes the previous version. If you perform a rollback to the previous version again, the library rolls back to library version V2.

Examples

# Roll back the IP reputation signature library to the previous version.

<Sysname> system-view

[Sysname] ip-reputation signature rollback last

Related commands

display ip-reputation signature library

ip-reputation signature update

Use ip-reputation signature update to manually update the IP reputation signature library.

Syntax

ip-reputation signature update file-path [ vpn-instance vpn-instance-name ] [ source { ip | ipv6 } { ip-address | interface interface-type interface-number } ]

Views

System view

Predefined user roles

network-admin

context-admin

Parameters

file-path: Specifies the IP reputation signature library file path, a string of 1 to 255 characters.

vpn-instance vpn-instance-name: Specifies the MPLS L3VPN instance to which the FTP or TFTP server belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the server belongs to the public network, do not specify this option.

source: Specifies the source IP address of the request packets sent to the TFTP or FTP server for the manual signature library update. If you do not specify a source IP address, the system uses the IP address of the outgoing routed interface as the source IP address.

ip ip-address: Specifies a source IPv4 address.

ipv6 ip-address: Specifies a source IPv6 address.

interface interface-type interface-number: Specifies an interface by its type and number. The primary IPv4 address or the lowest IPv6 address of the specified interface is used as the source IP address.

Usage guidelines

If the device cannot access the signature database services on the official website, use one of the following methods to manually update the IP reputation signature library:

·     Local update—Updates the IP reputation signature library by using a locally stored IP reputation signature library file. To use this method, first obtain the signature library file from the official website and import it to the device.

(In standalone mode.) Store the update file on the active MPU for successful signature library update.

(In IRF mode.) Store the update file on the global active MPU for successful signature library update.

The following describes the format of the file-path parameter for different update scenarios.

 

Update scenario	Format of file-path	Remarks
The update file is stored in the current working directory.	filename	To display the current working directory, use the pwd command. For information about the pwd command, see file system management in Fundamentals Command Reference.
The update file is stored in a different directory on the same storage medium.	filename	Before configuring the ip-reputation signature update command, use the cd command to open the directory where the file is stored. For information about the cd command, see file system management in Fundamentals Command Reference.
The update file is stored on a different storage medium.	path/filename	Before configuring the ip-reputation signature update command, use the cd command to open the root directory of the storage medium where the file is stored. For information about the cd command, see file system management in Fundamentals Command Reference.

 

·     FTP/TFTP update—Updates the IP reputation signature library by using the file stored on an FTP or TFTP server. The device automatically downloads the signature file from the server before using it to update the signature library.

The following describes the format of the file-path parameter for different update scenarios.

 

Update scenario	Format of file-path	Remarks
The update file is stored on an FTP server.	ftp://username:password@server/filename	The username parameter represents the FTP login username. The password parameter represents the FTP login password. The server parameter represents the IP address or host name of the FTP server. Replace the following special characters in the FTP login username and password with their respective escape characters: ·     Colon (:)—%3A or %3a. ·     At sign (@)—%40. ·     Forward slash (/)—%2F or %2f.
The update file is stored on a TFTP server.	tftp://server/filename	The server parameter represents the IP address or host name of the TFTP server.

 

	NOTE: To update the signature library successfully, make sure the device and the FTP or TFTP server can reach each other. If you specify the FTP or TFTP server by its host name, you must also make sure the device can resolve the host name into an IP address through static or dynamic DNS. For more information about DNS, see Layer 3—IP Services Configuration Guide.

 

To execute the ip-reputation signature update command, you also need to follow these restrictions and guidelines:

·     To use a specific source IP address for request packets sent to the TFTP or FTP server for manual signature library update, specify the source keyword. For example, if packets from the device must be translated by NAT before accessing the TFTP or FTP server, you must specify a source IP address complied with NAT rules for NAT translation. If NAT translation is performed by an independent NAT device, make sure the IP address specified by this command can reach the NAT device at Layer 3.

·     If you specify both source and vpn-instance keywords, make sure the VPN instance to which the specified source IP or interface belongs is the same as that specified by the vpn-instance keyword.

Examples

# Manually update the IP reputation signature library by using an IP reputation signature library file stored on a TFTP server.

<Sysname> system-view

[Sysname] ip-reputation signature update tftp://192.168.0.10/ip-1.0.2-en.dat

# Manually update the IP reputation signature library by using an IP reputation signature library file stored on the device. The file is stored in directory cfb0:/dpi/ip-1.0.23-en.dat, and the current working directory is cfa0:.

<Sysname> cd cfb0:/

<Sysname> system-view

[Sysname] ip-reputation signature update dpi/ip-1.0.23-en.dat

top-hit-statistics enable

Use top-hit-statistics enable to enable the top hit ranking feature for IP addresses.

Use undo top-hit-statistics enable to disable the top hit ranking feature.

Syntax

top-hit-statistics enable

undo top-hit-statistics enable

Default

The top hit ranking feature is disabled for IP addresses on the IP reputation list.

Views

IP reputation view

Predefined user roles

network-admin

context-admin

Usage guidelines

This feature takes effect after you enable IP reputation.

This feature enables the device to collect hit statistics for IP addresses on the IP reputation list and rank them. After you disable this feature, the device clears hit statistics for IP reputation.

Examples

# Enable the top hit ranking feature for IP addresses on the IP reputation list.

<Sysname> system-view

[Sysname] ip-reputation

[Sysname-ip-reputation] top-hit-statistics enable

Related commands

display ip-reputation top-hit-statistics

update schedule

Use update schedule to schedule the time for automatic IP reputation signature library update.

Use undo update schedule to restore the default.

Syntax

update schedule { daily | weekly { fri | mon | sat | sun | thu | tue | wed } } start-time time tingle minutes

undo update schedule

Default

The device starts updating the IP reputation signature library at a random time between 01:00:00 and 03:00:00 every day.

Views

Automatic IP reputation signature library update configuration view

Predefined user roles

network-admin

context-admin

Parameters

daily: Updates the IP reputation signature library every day.

weekly: Updates the IP reputation signature library every week.

fri: Updates the IP reputation signature library every Friday.

mon: Updates the IP reputation signature library every Monday.

sat: Updates the IP reputation signature library every Saturday.

sun: Updates the IP reputation signature library every Sunday.

thu: Updates the IP reputation signature library every Thursday.

tue: Updates the IP reputation signature library every Tuesday.

wed: Updates the IP reputation signature library every Wednesday.

start-time time: Specifies the start time in the hh:mm:ss format. The value range is 00:00:00 to 23:59:59.

tingle minutes: Specifies the tolerance time in minutes. The value range is 0 to 120. An automatic library update will occur at a random time between the following time points:

·     Start time minus half the tolerance time.

·     Start time plus half the tolerance time.

For example, if you specify the start time as 01:00:00 and the tolerance time as 60 minutes, the device will perform the update at a random time between 00:30:00 to 01:30:00.

Examples

# Configure the device to automatically update the IP reputation signature library every Monday at a random time between 20:25:00 and 20:35:00.

<Sysname> system-view

[Sysname] ip-reputation signature auto-update

[Sysname-ip-reputation-autoupdate] update schedule weekly mon start-time 20:30:00 tingle 10

Related commands

ip-reputation signature auto-update