# Attack Defense

> This skill should be used when the user asks to configure or troubleshoot Huawei USG6000E firewall attack defense features. Covers Anti-DDoS (SYN/UDP/HTTP flood), single-packet attack defense, URPF source-address validation, per-IP connection rate limiting, traffic-based dynamic CAR, and SACG admission control linkage. Applicable platforms USG6000E V600R007C20+ and USG6000/USG9500/NGFW Module V500R005C20+ (CLI syntax identical between versions).

- Skill: `nanxiaoyao/attack-defense` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add nanxiaoyao/attack-defense`
- Raw SKILL.md: https://api.skillmd.com/api/skills/nanxiaoyao/attack-defense/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: nanxiaoyao (https://skillmd.com/u/nanxiaoyao)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/nanxiaoyao/attack-defense

---


# 华为 USG 攻击防范配置技能 (attack-defense)

适用平台 USG6000E 系列 适用版本 V600R007C20+
文档来源 HUAWEI USG6000E V600R007C20 产品文档 (案例 sec_case_defend_*)

USG 攻击防范分三层 单包攻击防范（畸形/扫描类）+ 流量型攻击防范（DDoS）+ 应用层攻击防范（HTTP/DNS Flood）

## 触发场景
- 公网链路被刷流量 怀疑 DDoS
- 服务器 syn-flood / udp-flood 攻击
- 应用层 HTTP-flood CC 攻击
- 配置源地址校验 防 IP 欺骗
- 限制单 IP 新建连接数 防爬虫/扫描
- 联动 IDS/HiSec Insight 做高级威胁防御
- 终端准入 SACG 联动

## 防护体系全景

```
┌───────────────────────────────────────────────────┐
│ 应用层  HTTP-Flood / DNS-Flood / SIP-Flood        │
│  ├─ 指纹学习  dynamic-fingerprint-learn          │
│  └─ 源认证    source-detect                       │
├───────────────────────────────────────────────────┤
│ 流量层  SYN/UDP/ICMP Flood + 动态限流             │
│  ├─ alert-rate 阈值告警                           │
│  ├─ defend 启用清洗                               │
│  └─ auto-defend 动态 CAR                          │
├───────────────────────────────────────────────────┤
│ 单包层  畸形包 IP/TCP options 扫描                │
│  └─ firewall defend XXX enable                    │
├───────────────────────────────────────────────────┤
│ 入口层  URPF 反向路径校验 防 IP 欺骗              │
└───────────────────────────────────────────────────┘
```

## 一 Anti-DDoS 防 DDoS

### 配置三步走
1. 接口启用流量统计 `anti-ddos flow-statistic enable`
2. 启用基线学习 自适应阈值 `anti-ddos baseline-learn start`
3. 配置各攻击类型 alert/defend

### 经典模板 来自 sec_case_defend_0005
```
system-view
interface GigabitEthernet 0/0/1
 anti-ddos flow-statistic enable
 quit
anti-ddos syn-flood source-detect
anti-ddos syn-flood defend alert-rate 3000
anti-ddos udp-flood dynamic-fingerprint-learn alert-speed 80
anti-ddos udp-frag-flood dynamic-fingerprint-learn alert-speed 50
anti-ddos http-flood defend alert-rate 9000
anti-ddos http-flood source-detect mode basic
anti-ddos baseline-learn tolerance-value 100
anti-ddos baseline-learn start
```

### 阈值原则
- 业务峰值 ×3 作为 alert-rate
- 先观察 1-2 周 学习基线 再开 defend
- tolerance-value 100 表示允许超基线 100%

## 二 单包攻击防范

适用：畸形包 land smurf fraggle teardrop 端口扫描 IP-Sweep TCP options

```
firewall defend land enable
firewall defend smurf enable
firewall defend fraggle enable
firewall defend tcp-flag enable
firewall defend ip-fragment enable
firewall defend ip-spoofing enable
firewall defend route-record enable
firewall defend source-route enable
firewall defend ip-sweep enable
 firewall defend ip-sweep max-rate 5000 blacklist-timeout 20
firewall defend port-scan enable
 firewall defend port-scan max-rate 4000 blacklist-timeout 20
```

## 三 URPF 反向路径校验

防伪源地址 防地址欺骗 IP-spoofing

### IPv4
```
interface GigabitEthernet 0/0/1
 ip urpf { strict | loose } [ allow-default-route ] [ acl <num> ]
```

### IPv6
```
interface GigabitEthernet 0/0/1
 ipv6 enable
 ipv6 address 2002::2 64
 ipv6 urpf { strict | loose } [ allow-default-route ] [ acl6 <num> ]
```

模式选择：
- strict 严格 入接口必须是该源地址回包的最优出接口（适合 ISP 边界）
- loose 宽松 路由表里有该源即可（适合不对称路由场景）

## 四 流量型攻击动态限流 auto-defend CAR

适用：检测到攻击源后 自动对其限速 不影响整体业务

```
anti-ddos auto-defend traffic-policy enable
anti-ddos auto-defend car 50000               # 限速值 单位 bps
anti-ddos auto-defend base-session enable     # 启用会话基线
anti-ddos auto-defend base-session alert-rate 100000 max-rate 200000
```

## 五 每 IP 新建连接限速

防爬虫 慢速扫描

```
firewall statistic system enable
ip-link check enable
firewall session aging-time service-set <service> <s>

# 创建限速对象
firewall ip-link 1 destination <ip>
# 或基于策略限速
security-policy
 rule name limit_per_source
  source-zone untrust
  destination-zone trust
  action permit
  session aging-time 60
```

更细粒度：
```
firewall session link-state check
firewall defend connection-limit enable
firewall defend connection-limit max-num <num>
```

## 六 SACG 终端准入联动

USG 作为安全接入控制网关 联动 Agile Controller 做终端合规

旁挂模式（sec_case_defend_0022）：
```
right-manager server-group
 server authentication 10.1.1.1 1645 shared-key cipher Admin@123
 server authentication source ip 192.168.10.1
 default authentication policy permit
right-manager
 firewall id 5
```

直路模式（sec_case_defend_0023）：在所有终端流量必经接口启用

## 七 查看与诊断

| 命令 | 说明 |
|---|---|
| display anti-ddos statistics | 总览攻击统计 |
| display anti-ddos baseline-learn information | 基线学习状态 |
| display anti-ddos syn-flood defend | SYN flood 防御状态 |
| display anti-ddos http-flood defend | HTTP flood 防御 |
| display anti-ddos abnormal source-ip | 异常源 IP 列表 |
| display firewall blacklist item | 黑名单 |
| display firewall statistic system | 系统级会话/速率统计 |
| display ip urpf | URPF 状态 |
| display firewall defend flag | 单包防御开启情况 |

## 八 常见陷阱
- 没启 `anti-ddos flow-statistic enable` 就开防御 → 看不到攻击源
- alert-rate 设太低 → 误杀正常业务 必须先学基线
- URPF strict 用在不对称路由 → 合法流量被丢
- HTTP-flood source-detect basic 在 CDN/反向代理后 → 把代理 IP 当攻击源 用 advanced 模式
- 黑名单超时 blacklist-timeout 设太长 → 误判恢复慢 建议先 30s

## 相关文件
- references/defend-commands.md   完整命令速查
- references/defend-troubleshooting.md   防御误判与调优