MSR 2660 防火墙及DDOS攻击防御

现在的问题是，我已经在2个拨号口dialer10、dialer11上开启了deny 所有的ICMP包，那为什么还会有这么多的ICMP destination unreachable攻击呢？还有就是UDP FLOOD的攻击，我该怎么防御呢？

下面的被攻击的数据只是2个小时产生的。

MSR 2660有2个Wan口，XGE0/0/10 XGE0/0/11连接了2个光猫，由MSR2660拨号。

开启了DDOS防御和防火墙限制ICMP，配置如下。

Advanced IPv4 ACL named Ten-GigabitEthernet0/0/10, 1 rule,

ACL's step is 5, start ID is 5

rule 5 deny icmp destination object-group wan time-range icmp (Active) (15828 times matched)

Advanced IPv4 ACL named Ten-GigabitEthernet0/0/11, 1 rule,

ACL's step is 5, start ID is 5

rule 5 deny icmp destination object-group wan time-range icmp (Active) (5141 times matched)

Ip address object group wan: 1 object(in use)

 0 network subnet 118.76.0.0 255.255.0.0 （这个地址是联通分配给PPPOE拨号的公网IP段）

dialer 10

packet-filter name Ten-GigabitEthernet0/0/10 inbound

attack-defense apply policy AtkInterface65541

dialer 11

packet-filter name Ten-GigabitEthernet0/0/11 inbound

attack-defense apply policy AtkInterface65542

配置验证如下：

Advanced IPv4 ACL named Ten-GigabitEthernet0/0/10, 1 rule,

ACL's step is 5, start ID is 5

 rule 5 deny icmp destination object-group wan time-range icmp (Active) (15828 times matched)

Advanced IPv4 ACL named Ten-GigabitEthernet0/0/11, 1 rule,

ACL's step is 5, start ID is 5

 rule 5 deny icmp destination object-group wan time-range icmp (Active) (5141 times matched)

dis attack-defense statistics interface Dialer 10

Attack policy name: AtkInterface65541

Slot 0:

Scan attack defense statistics:

 AttackType                          AttackTimes Dropped

 No scanning attacks detected.

Flood attack defense statistics:

 AttackType                          AttackTimes Dropped

 UDP flood                           244         372977     

Signature attack defense statistics:

 AttackType                          AttackTimes Dropped

 TCP null flag                       5           5          

 TCP all flags                       3           3          

 ICMP destination unreachable        1807        1807

dis attack-defense statistics interface Dialer 11

Attack policy name: AtkInterface65542

Slot 0:

Scan attack defense statistics:

 AttackType                          AttackTimes Dropped

 No scanning attacks detected.

Flood attack defense statistics:

 AttackType                          AttackTimes Dropped

 UDP flood                           153         49238      

Signature attack defense statistics:

 AttackType                          AttackTimes Dropped

 TCP null flag                       1           1          

 TCP all flags                       4           4          

 ICMP destination unreachable        1332        1332