Adding a Hardware Filter

Procedure

1. Choose Defense > Policy Settings > Filter > Hardware Filter.
2. Click .
3. On the Basic Information tab, configure basic information about the hardware filter. For detailed parameter description, see Table 1.

   Table 1 Basic information about the hardware filter

   Parameter	Description
   Name	Indicates the name of a hardware filter. The value is a unique string of 1 to 64 case-insensitive characters that can contain letters, digits, and underscores (_) and must start with a letter.
   Protocol Type	Indicates the protocol type, which can be IPv4 or IPv6.
   Protocol	Protocol type: IPv4 The protocols include ID, ICMPv4, TCP, UDP, and IPv4. If the protocol ID is selected, the protocol ID text box is displayed for you to enter a protocol ID. Each ID corresponds to a protocol. The value ranges from 0 to 255. Protocol type: IPv6 The protocols include ID, ICMPv6, TCP, UDP, and IPv6. If the protocol ID is selected, the protocol ID text box is displayed for you to enter a protocol ID. Each ID corresponds to a protocol. The value ranges from 0 to 255.
   Operation	Indicates the action, which can be discard and rate limit.
   Rate threshold (Kbps)	Indicates the rate threshold, which needs to be set when the action is rate limit. NOTICE: The rate limit unit is an NP chip.

   Click the Rule tab and set rule parameters. When the protocol type is IPv4, refer to Table 2 for rule parameter settings. When the protocol type is IPv6, refer to Table 3 for rule parameter settings.

   Table 2 Rules for the hardware filter of the IPv4 protocol type

   Parameter	Description
   Source IP address	Indicates the source IP address, which can be an IPv4 address.
   Destination IP address	Indicates the destination IP address, which can be an IPv4 address.
   Source port	Indicates the source port, which can be a value or range.
   Destination Port	Indicates the destination port, which can be a value or range.
   Packet length threshold/range (byte)	Indicates the packet length range, for example, 100-200.
   TCP Flag	This parameter is optional and empty by default. The first item in the drop-down list box indicates the default value.
   Fragment type	Indicates the fragment type, which can be fragment or non-fragment.

   Table 3 Rules for the hardware filter of the IPv6 protocol type

   Parameter	Description
   Destination IP address	Indicates the source IP address, which can be an IPv6 address.
   Source port	Indicates the source port, which can be a value or range.
   Destination Port	Indicates the destination port, which can be a value or range.
   Packet length threshold/range (byte)	Indicates the packet length range, for example, 100-200.
   TCP Flag	This parameter is optional and empty by default. The first item in the drop-down list box indicates the default value.

4. Bind a device to the hardware filter.
   1. Click the Associate Device tab.
   2. Click , select a device, and click OK.

      Only the devices whose Deployment Status is Succeeded are displayed on the page. Ensure that the device to be bound has been deployed.

5. Click Deploy.
   • When the device is associated with the hardware filter and you click Deploy, the hardware filter is deployed on the AntiDDoS and configurations take effect.
   • If only a hardware filter is created and no device is associated, after you click Deploy, the hardware filter configuration is saved in the ATIC management center. The hardware filter takes effect only after it is associated with the device and deployed again.