R3303-HP HSR6800 Routers Security Configuration Guide

33
Task Remarks
Configuring ARP gateway
protection
Optional.
Configure this function on access devices
(recommended).
Configuring ARP filtering
Optional.
Configure this function on access devices
(recommended).
Configuring unresolvable IP attack protection
If a device receives from a host a large number of IP packets that cannot be resolved by ARP (called
unresolvable IP packets), the following situations can occur:
• The device sends a large number of ARP requests, overloading the target subnets.
• The device keeps trying to resolve target IP addresses, overloading its CPU.
To protect the device from such IP packet attacks, you can configure the following features:
• ARP source suppression—If the attack packets have the same source address, you can enable the
ARP source suppression function, and set the maximum number of unresolvable IP packets that a
host can send within 5 seconds. If the threshold is reached, the device stops resolving packets from
the host until the five seconds elapse.
• ARP blackhole routing—You can enable the ARP blackhole routing function regardless of whether
the attack packets have the same source address. After receiving an unresolvable IP packet, the
device creates a blackhole route destined for that IP address and drops all matching packets until
the blackhole route ages out.
Configuring ARP source suppression
Ste
p
Command Remarks
1. Enter system view.
system-view N/A
2. Enable ARP source suppression.
arp source-suppression enable Disabled by default.
3. Set the maximum number of unresolvable
packets that the device can receive from a
device in five seconds.
arp source-suppression limit
limit-value
Optional.
10 by default.
Enabling ARP blackhole routing
Ste
p
Command Remarks
1. Enter system view.
system-view N/A
2. Enable ARP blackhole
routing.
arp resolving-route enable
Optional.
Disabled by default.