config security dos dns-query-flood-protection
Use this command to configure a DNS Query Flood Protection policy to limit the number of DNS request per second which can mitigate against DNS query flood attacks.
Syntax
config security dos dns-query-flood-protection
edit <name>
set status {enable | disable}
set dns-query-rate-limit <integer>
set action {pass | deny}
set log {enable | disable}
set severity {high | medium | low}
next
end
status |
Enable/disable the status of this DNS Query Flood Protection policy. |
dns-query-rate-limit |
Specify the allowable number of DNS requests per second. The range is 0 to 1048567. The default is 0, which means that no limit is placed on the number of DNS queries that can be made per second. Note:
|
action |
Select the corresponding action to take when the DNS Query Rate Limit is exceeded:
deny is the default option. |
log |
Enable/disable logging for the Action. This is disabled by default. |
severity |
Select the event severity to log when the DNS Query Flood Protection policy is triggered:
The default is high. |
Example
config security dos dns-query-flood-protection
edit "DNS_Query_Flood_1"
set status enable
set dns-query-rate-limit 2
set action deny
set log disable
set severity high
next
end