Configuring Global Defense Policies

This section describes how to configure global defense policies on the ATIC. Only the inbound traffic supports the defense mode. The outbound traffic does not.

Choose Defense > Policy Settings > Global Policy and configure global defense policies:

Enable location statistics	Select the check box in front of the device and click to enable the global location statistics function. In the dialog box that is displayed, click OK. The Execution Result dialog box is displayed, indicating whether the function is enabled. Click Close.
Disable location statistics	Select the check box in front of the device and click to disable the global location statistics function. In the dialog box that is displayed, click OK. The Execution Result dialog box is displayed, indicating whether the function is disabled. Click Close.
Save device configuration	Select the check box in front of the device and click to save the configuration. In the dialog box that is displayed, click OK. The Execution Result dialog box is displayed, indicating whether the configuration is saved. Click Close.
Import	Click to import Zones in batches. Select the file to be imported and click OK. For details, see Importing Zones in a Batch. NOTE: The file to be imported must be an XML file exported from the ATIC. The values of elements in the file can be changed, but the file structure cannot. The data of one device can be imported each time. The dimensions of imported contents are the same as those of exported contents.
Export	Select a device and click . In the Export device configuration dialog box, select Export content. The following contents of selected Zones are as follows (you can select one or more as required): Global policy: exports the global configuration of a device. IP location: indicates the IP location configuration and the binding to Zones. Filter: indicates the filtering rule configuration and the binding to Zones. Defense policy: exports the defense policy configuration of all Zones from the device. Click OK. The XML file is exported. Information about only one device can be exported each time.

Configuring Basic Attack Defense
Basic attacks are traditional single-packet Denial of Service (DoS) attacks. The basic attack defense mainly defends against scanning and sniffing attacks, malformed packet attacks, and special packet attacks. When the rate of single-packet attack traffic is greater than or equal to 2500 pps, the ATIC displays this alarm event. When the rate of single-packet attack traffic is less than 2500 pps, the ATIC does not display this alarm event. The following alarm event types are available: Global TCP abnormal, Global UDP abnormal, and Global ICMP abnormal. By default, basic attack defense is disabled. You can determine whether to enable attack defense functions according to actual services on the network.
Blacklist and Whitelist
This section describes how to configure the blacklist and whitelist functions in the ATIC management center.
Configure Proxy IP Address
This command is used for HTTP traffic protection in a CDN scenario. This section describes how to configure proxy IP addresses.
Domain Audit
A domain name whitelist can be configured through domain name audit, so that only traffic of access to domain names matching the whitelist is permitted and that other traffic is blocked. This section describes how to enable the domain name audit function in the global configuration.
Configuring Global IP Reputation

Parent topic: Configuring the Zone-based Defense Policy