firewall defend ip-fragment enable

Function

The firewall defend ip-fragment enable command enables the IP fragment attack defense.

The undo firewall defend ip-fragment enable command disables the IP fragment attack defense.

firewall defend ip-fragment enable

undo firewall defend ip-fragment enable

None

System view

2: Configuration level

By default, the IP fragment attack defense is disabled.

After IP fragment attack defense is enabled, a FW discards the packets and logs attacks in any of the following cases:

The DF and MF flag bits are both 1.
The DF flag bit is 1, and the fragment offset exceeds 0 bytes.
The DF flag bit is 0, and the total of the fragment offset and the length fields exceeds 65535 bytes.

# Enable the IP fragment attack defense.

<sysname> system-view
[sysname] firewall defend ip-fragment enable