Cisco SCE8000 Specifications download pdf (Page 72)

100

101

2-32

Cisco SCE 8000 CLI Command Reference

Chapter 2 CLI Command Reference

attack-filter dont-filter | force-filter

Prevents attack filtering for a specified IP address or protocol. If filtering is already in process, it will be

stopped. When attack filtering has been stopped, it remains stopped until explicitly restored by another

CLI command (either specific or general). To restore attack filtering, use the no form of this command.

The force-filter option forces attack filtering for a specified IP address or protocol. When attack filtering

has been forced, it continues until explicitly stopped by another CLI command (either specific or

general). To stop attack filtering, use the no form of this command.

attack-filter force-filter [action {block | report}] protocol {TCP | UDP | ICMP | other}

[destination-port {port-number | not-specific}] attack-direction {single-side-source |

single-side-destination | single-side-both | dual-sided} {ip ip-address | dual-sided source-ip

ip-address destination-ip ip-address | dual-sided source-ipv6 ipv6-address destination-ipv6

ipv6-address} side {both | network | subscribe}

attack-filter dont-filter protocol {TCP | UDP | ICMP | other} attack-direction

{single-side-source | single-side-destination | single-side-both | dual-sided} {ip ip-address |

dual-sided source-ip ip-address destination-ip ip-address | dual-sided source-ipv6

ipv6-address destination-ipv6 ipv6-address} side {both | network | subscribe}

no attack-filter dont-filter protocol {TCP | UDP | ICMP | other} attack-direction

{single-side-source | single-side-destination | single-side-both| dual-sided} {ip ip-address |

dual-sided source-ip ip-address destination-ip ip-address | dual-sided source-ipv6

ipv6-address destination-ipv6 ipv6-address} side {both | network | subscribe}

no attack-filter force-filter protocol {TCP | UDP | ICMP | other} [destination-port

{port-number | not-specific}] attack-direction {single-side-source | single-side-destination |

single-side-both | dual-sided) {ip ip-address | dual-sided source-ip ip-address destination-ip

ip-address | dual-sided source-ipv6 ipv6-address destination-ipv6 ipv6-address} side {both |

network | subscribe}

no attack-filter force-filter all

no attack-filter dont-filter all

Syntax Description action (force-filter

option only)

Specifies the action the force-filter option should perform. Choose either

block or report.

protocol Choose TCP,

UDP, ICMP, or other.

destination port (TCP and UDP protocols only) Defines whether specific IP detection is

forced or prevented for the specified port number or is port-less (not

specific).

Choose port-number or not-specific.

attack direction Defines whether specific IP detection is forced or prevented for single-sided

or dual-sided attacks:

• Single-sided—Specify the direction (single-side-source,

single-side-destination, single-side-both) and the IP address.

• Dual-sided—Specify dual-sided and both the source IP address and the

destination IP address.

1 2 ... 67 68 69 70 71 72 73 74 75 76 77 ... 777 778

Cisco SCE8000 Specifications Page 72

Comments to this Manuals