230
C
HAPTER
25: 802.1
X
C
ONFIGURATION
Packet Attack
Prevention
Configuration
With the expansion of Internet scale and the increase of Internet users, the
possibility that networking equipment gets attacked is increasing. Specific to some
typical attack modes, the Switch 8800 Family series switches provides a series of
schemes of preventing attacks against packets to protect the networking
equipment against attacked from IP, ARP, 802.1x and unknown multicast packets.
■
IP Packet attack: It refers to such a situation that the Switch 8800 Family switch
receives too many IP packets whose destination addresses and VLAN interface
addresses are within the same network segment, while the corresponding
forwarding entries do not exist on the switch. Such packets will be delivered to
the CPU for processing. They occupy lots of CPU resources, and even affect the
forwarding of normal packets.
■
ARP packet attack: It refers to such a situation that the Switch 8800 Family
switch receives a large number of ARP request packets with the same or similar
source MAC addresses. These packets affect the normal ARP learning.
■
802.1x packet attack: It refers to such a situation that the Switch 8800 Family
switch receives a large number of 8021.x authentication packets with the same
or similar source MAC addresses. These packets largely occupy the CPU
resources.
Perform the following configuration in system view.
By default, IP packet attack prevention is enabled while ARP packet attack
prevention and dot1x packet attack prevention are disabled by default.
802.1x Configuration
Example
Network requirements
As shown in Figure 59, the workstation of a user is connected to the port Ethernet
3/1/1 of the Switch.
The switch administrator will enable 802.1x on all the ports to authenticate the
supplicants so as to control their access to the Internet. The access control mode is
configured as based on the MAC address
All the supplicants belong to the default domain 3Com163.net, which can contain
up to 30 users. RADIUS authentication is performed first. If there is no response
from the RADIUS server, local authentication will be performed. For accounting, if
the RADIUS server fails to account, the user will be disconnected. In addition,
Enable the error/event/packet/all debugging
of 802.1x
debugging dot1x
{
error
|
event
|
packet
|
all
}
Disable the error/event/packet/all debugging
of 802.1x.
undo debugging dot1x
{
error
|
event
|
packet
|
all
}
Table 195
Display and debug 802.1x
Operation Command
Table 196
Enable/disable packet attack prevention
Operation
Command
Enable/Disable packet attack prevention
anti-attack
{
arp
|
dot1x
|
ip
} {
disable
|
enable
}
Summary of Contents for Switch 8807
Page 14: ......
Page 32: ...32 CHAPTER 2 COMMAND LINE INTERFACE...
Page 50: ...50 CHAPTER 5 MANAGEMENT INTERFACE CONFIGURATION...
Page 54: ...54 CHAPTER 6 CONFIGURATION FILE MANAGEMENT...
Page 64: ...64 CHAPTER 8 SUPER VLAN CONFIGURATION...
Page 70: ...70 CHAPTER 9 ISOLATE USER VLAN CONFIGURATION...
Page 78: ...78 CHAPTER 10 IP ADDRESS CONFIGURATION...
Page 82: ...82 CHAPTER 11 IP PERFORMANCE CONFIGURATION flag ACK window 16079...
Page 100: ...100 CHAPTER 13 ETHERNET PORT CONFIGURATION...
Page 114: ...114 CHAPTER 15 PORT ISOLATION CONFIGURATION...
Page 158: ...158 CHAPTER 18 DIGEST SNOOPING CONFIGURATION...
Page 162: ...162 CHAPTER 19 FAST TRANSITION...
Page 219: ......
Page 220: ...220 CHAPTER 24 VLAN ACL CONFIGURATION...
Page 234: ...234 CHAPTER 25 802 1X CONFIGURATION...
Page 284: ...284 CHAPTER 28 IP ROUTING PROTOCOL OVERVIEW...
Page 290: ...290 CHAPTER 29 STATIC ROUTE CONFIGURATION...
Page 338: ...338 CHAPTER 31 OSPF CONFIGURATION...
Page 392: ...392 CHAPTER 33 BGP CONFIGURATION...
Page 404: ...404 CHAPTER 34 IP ROUTING POLICY CONFIGURATION...
Page 406: ...406 CHAPTER 35 ROUTE CAPACITY CONFIGURATION...
Page 408: ...408 CHAPTER 36 RECURSIVE ROUTING CONFIGURATION...
Page 416: ...416 CHAPTER 37 IP MULTICAST OVERVIEW...
Page 430: ...430 CHAPTER 39 IGMP SNOOPING CONFIGURATION...
Page 454: ...454 CHAPTER 42 IGMP CONFIGURATION...
Page 462: ...462 CHAPTER 43 PIM DM CONFIGURATION...
Page 506: ...506 CHAPTER 46 MBGP MULTICAST EXTENSION CONFIGURATION...
Page 528: ...528 CHAPTER 48 MPLS BASIC CAPABILITY CONFIGURATION...
Page 632: ...632 CHAPTER 51 MPLS VLL...
Page 652: ...652 CHAPTER 52 VPLS CONFIGURATION...
Page 666: ...666 CHAPTER 53 VRRP CONFIGURATION...
Page 680: ...680 CHAPTER 56 ARP TABLE SIZE CONFIGURATION...
Page 718: ...718 CHAPTER 59 NETSTREAM CONFIGURATION...
Page 728: ...728 CHAPTER 61 POE CONFIGURATION...
Page 736: ...736 CHAPTER 63 UDP HELPER CONFIGURATION...
Page 746: ...746 CHAPTER 64 SNMP CONFIGURATION...
Page 792: ...792 CHAPTER 68 FILE SYSTEM MANAGEMENT...
Page 800: ...800 CHAPTER 69 DEVICE MANAGEMENT...
Page 810: ...810 CHAPTER 70 FTP TFTP CONFIGURATION...
Page 840: ...840 CHAPTER 72 SYSTEM MAINTENANCE AND DEBUGGING...
Page 844: ...844 CHAPTER 74 PACKET STATISTICS CONFIGURATION...
Page 846: ...846 CHAPTER 75 ETHERNET PORT LOOPBACK DETECTION...
Page 860: ...860 CHAPTER 76 QINQ CONFIGURATION...
Page 866: ...866 CHAPTER 77 NQA CONFIGURATION...
Page 876: ...876 CHAPTER 78 PASSWORD CONTROL CONFIGURATION...