config security dos dns-reverse-flood-protection

Use this command to configure a DNS Reverse Flood Protection policy to limit the number of ANY type DNS requests per second which can mitigate against DNS reverse flood attacks.

Syntax

edit <name>

set status {enable | disable}

set dns-query-any-rate-limit <integer>

set action {pass | deny}

set log {enable | disable}

set severity {high | medium | low}

end

status	Enable/disable the status of this DNS Reverse Flood Protection policy.
dns-query-any-rate-limit	Specify the allowable number of DNS requests per second, with query type ANY. The range is 0 to 1048567. The default is 0, which means that no limit is placed on the number of DNS queries that can be made per second. Note: Multiple "rate limit" type of operations may be executed through various configurations, however, they cannot be executed all at once. Priority is given to certain rate limit operations. The following lists the execution sequence. Transaction Rate Limit (from the virtual server configuration). DNS Query Rate Limit (from DNS Query Flood Protection policy). ANY Query Rate Limit (from DNS Reverse Flood Protection policy).
action	Select the corresponding action to take when the ANY Query Rate Limit is exceeded: pass — Allow the traffic. deny — Drop the traffic, send a 400 Bad request to the client. deny is the default option.
log	Enable/disable logging for the Action. This is disabled by default.
severity	Select the event severity to log when the DNS Reverse Flood Protection policy is triggered: high — Log as high severity events. medium — Log as a medium severity events. low — Log as low severity events. The default is high.

Example

config security dos dns-query-flood-protection

edit "DNS_Reverse_Flood_1"

set status enable

set dns-query-rate-limit 1

set action pass

set log enable

set severity high

end

config security dos dns-reverse-flood-protection

Use this command to configure a DNS Reverse Flood Protection policy to limit the number of ANY type DNS requests per second which can mitigate against DNS reverse flood attacks.

Syntax

config security dos dns-reverse-flood-protection

edit <name>

set status {enable | disable}

set dns-query-any-rate-limit <integer>

set action {pass | deny}

set log {enable | disable}

set severity {high | medium | low}

end

status	Enable/disable the status of this DNS Reverse Flood Protection policy.
dns-query-any-rate-limit	Specify the allowable number of DNS requests per second, with query type ANY. The range is 0 to 1048567. The default is 0, which means that no limit is placed on the number of DNS queries that can be made per second. Note: Multiple "rate limit" type of operations may be executed through various configurations, however, they cannot be executed all at once. Priority is given to certain rate limit operations. The following lists the execution sequence. Transaction Rate Limit (from the virtual server configuration). DNS Query Rate Limit (from DNS Query Flood Protection policy). ANY Query Rate Limit (from DNS Reverse Flood Protection policy).
action	Select the corresponding action to take when the ANY Query Rate Limit is exceeded: pass — Allow the traffic. deny — Drop the traffic, send a 400 Bad request to the client. deny is the default option.
log	Enable/disable logging for the Action. This is disabled by default.
severity	Select the event severity to log when the DNS Reverse Flood Protection policy is triggered: high — Log as high severity events. medium — Log as a medium severity events. low — Log as low severity events. The default is high.

Example

config security dos dns-query-flood-protection

edit "DNS_Reverse_Flood_1"

set status enable

set dns-query-rate-limit 1

set action pass

set log enable

set severity high

end