security dos udp-portlist

security dos udp-portlist(1)  BIG-IP TMSH Manual  security dos udp-portlist(1)



NAME
       udp-portlist - Configures the DoS udp portlist component within the
       security dos module using the syntax shown in the following sections.
       These DoS udp portlist entries are applied to all udp packets except
       those going through the management interface.

MODULE
       security dos

SYNTAX
   MODIFY
	modify udp-portlist dos-udp-portlist
	 options:
	  description [string]
	  list-type [exclude-listed-ports | include-listed-ports]
	  entries [modify | replace-all-with] {
	     [entry] {
	       options:
		description [string]
		match-direction [both | dst | none | src]
		port-number [number]
	     }
	  }

   DISPLAY
	list udp-portlist

DESCRIPTION
       You can use the udp-portlist component to configure a DoS UDP portlist
       of upto eight entries for all UDP traffic except the management
       interface.  The HSB hardware compares all incoming UDP traffic to the
       udp-portlist entries.  There are 2 types of behavior, depending upon
       whether the udp port list is configured as a white list or as a black
       list. White list and black list are mutually exclusive properties of a
       UDP port list.

       If the udp port list is configured as a list-type of exclude-listed-
       ports, and if a match is found on an incoming packet, then we do not
       increment the UDP Flood DoS vector.  If a match is not found, then the
       UDP Flood DoS vector checks are done on those packets.

       If the udp port list is configured as a list-type of include-listed-
       ports, and if a match is found on an incoming packet, then we increment
       the UDP Flood DoS vector. If a match is not found, then the UDP Flood
       DoS vector checks are not done on the packets.

       Either destination port or source port or both can be specified in a
       udp-portlist entry.

EXAMPLES
       modify udp-portlist dos-udp-portlist description "bad ports" list-type
       include-listed-ports Modifies the udp-portlist dos-udp-portlist to a
       blacklist.

       modify udp-portlist dos-udp-portlist list-type exclude-listed-ports
       Modifies the udp-portlist dos-udp-portlist to a white-list.

       modify udp-portlist dos-udp-portlist description "bad ports" entries
       modify { entry1 { match-direction src port-number 161 } } Modifies an
       entry. The new entry is for source UDP port 161. It matches any UDP
       packet whose source port is 161.

       modify udp-portlist dos-udp-portlist entries modify { 161 { match-
       direction both } }

       Modifies the entry for destination UDP port 161 to source and
       destination port 161. It matches any UDP packet whose destination or
       source port is 161.

	security dos udp-portlist dos-udp-portlist {
	   entries {
	       entry1 {
		   match-direction both
		   port-number snmp
	       }
	       entry2 { }
	       entry3 { }
	       entry4 { }
	   }
	   white-list
	}

       Displays the current list of DoS UDP portlist entries.

OPTIONS
       description
	    Your description for the DoS udp-portlist.

       list-type
	    Sets the list type to be either exclude-listed-ports or include-
	    listed-ports

	    include-listed-ports
		 Sets the property of the dos-udp-portlist list to include-
		 listed-ports (Blacklist).

	    exclude-listed-ports
		 Sets the property of the dos-udp-portlist list to  exclude-
		 listed-ports (Whitelist).

       entries
	    Modifies a udp-portlist entry.

	    modify
		 Modifies the existing entry that you specify next, in curly
		 braces ({}).  After the entry name,  enter the new
		 configuration (port mode and port number) settings for the
		 entry inside a nested set of curly braces.

	    replace-all-with
		 Replaces the current set of udp-portlist entries with the
		 entry(s) that you specify next, in curly braces ({}).

	    Enter the name of a entry to be  modified, then enter an open
	    curly brace ({), one or more of the following options, and a
	    closed curly brace (}).

	    description
		 Your description for the current entry.

	    match-direction
		 Set the mode of matching (source, destination or both).

	    port-number
		 Set the port number for matching.

SEE ALSO
       edit, list, modify, security, security dos, tmsh

COPYRIGHT
       No part of this program may be reproduced or transmitted in any form or
       by any means, electronic or mechanical, including photocopying,
       recording, or information storage and retrieval systems, for any
       purpose other than the purchaser's personal use, without the express
       written permission of F5 Networks, Inc.

       F5 Networks and BIG-IP (c) Copyright 2008, 2012-2016. All rights
       reserved.



BIG-IP				  2016-03-14	  security dos udp-portlist(1)