F3726, F3211, F3174, R5135, R3816-HP Firewalls and UTM Devices Attack Protection Configuration Guide-6PW100

50
Task Remarks
331H
Configuring ARP automatic scanning and fixed
ARP
Optional.
Configure this function on gateways (recommended).
15B
Configuring unresolvable IP attack protection
Unresolvable IP attack protection can be configured only at the CLI.
If a device receives from a host a large number of IP packets that cannot be resolved by ARP (called
unresolvable IP packets), the following situations can occur:
• The device sends a large number of ARP requests, overloading the target subnets.
• The device keeps trying to resolve target IP addresses, overloading its CPU.
To protect the device from such IP packet attacks, you can configure the following features:
• ARP source suppression—If the attack packets have the same source address, you can enable the
ARP source suppression function, and set the maximum number of unresolvable IP packets that a
host can send within five seconds. If the threshold is reached, the device stops resolving packets
from the host until the five seconds elapse.
• ARP black hole routing—You can enable the ARP black hole routing function regardless of whether
the attack packets have the same source address. After receiving an unresolveble IP packet, the
device creates a black hole route destined for that IP address and drops all the matching packets
until the black hole route ages out.
75BConfiguring ARP source suppression
Ste
p
Command Remarks
1. Enter system view.
system-view N/A
2. Enable ARP source suppression.
arp source-suppression enable Disabled by default.
3. Set the maximum number of unresolvable
packets that the device can receive from a
device in five seconds.
arp source-suppression limit
limit-value
Optional.
10 by default.
76BEnabling ARP black hole routing
Ste
p
Command Remarks
1. Enter system view.
system-view N/A
2. Enable ARP black hole
routing.
arp resolving-route enable
Optional.
Disabled by default.