config security dos exception

Use this command to configure DoS Exceptions, allowing trusted IPv4 addresses to bypass specific DoS inspection mechanisms in Networking-type DoS protection profiles. Exceptions can be applied to the following protection types:

• IP Fragmentation Protection (see config security dos ip-fragmentation-protection)

• TCP SYN Flood (see config security dos tcp-synflood-protection)

• TCP Slow Data Flood (see config security dos tcp-slowdata-attack-protection)

• TCP Connection Access Flood (see config security dos tcp-access-flood-protection)

Syntax

config security dos exception
  edit <name>
    config  exception-rule
      edit <No.>
        set type {ip-netmask|ip-range}
        set ip-network <IPv4/netmask>
        set start-ip <IPv4 address>
        set end-ip <IPv4 address>
      next
    end
  next
end

type	Specifies the format used to define the exception source. ip-netmask – Defines a network or host using CIDR notation. This is the default option. ip-range – Defines a range of individual IP addresses.
ip-network	The ip-network option is available by default, as the type is initially set to ip-netmask. Defines the exception source using CIDR format. Example: 192.0.2.5/24 Default: 0.0.0.0/0
start-ip	The start-ip option is available when type is ip-range. Specifies the beginning of the IP address range to exclude from DoS inspection. Example: 192.0.2.0 Default: 0.0.0.0
end-ip	The end-ip option is available when type is ip-range. Specifies the end of the IP address range to exclude from DoS inspection. Example: 192.0.3.0 Default: 0.0.0.0

Example

config security dos exception
  edit "exception_1"
    config  exception-rule
      edit 254
        set ip-network 128.1.2.254/32
      next
      edit 255
        set type ip-range
        set start-ip 128.1.3.1
        set end-ip 128.1.3.255
      next
    end
  next
end