The Number Limitation Function of MAC and IP in Port, VLAN Configuration
439
48.3
The Number Limitation Function of MAC and IP in
Port, VLAN Typical Examples
Fig 48-1 The Number Limitation of MAC and IP in Port, VLAN Typical Configuration
Example
In the network topology above, SWITCH B connects to many PC users, before
enabling the number limitation function of MAC and IP in Port, VLAN, if the system
hardware has no other limitation, SWTICH A and SWTICH B can get the MAC, ARP, ND
list entries of all the PC, so limiting the MAC, ARP list entry can avoid DOS attack to a
certain extent. When malicious users frequently do MAC, ARP cheating, it will be easy for
them to fill the MAC, ARP list entries of the switch, causing successful DOS attacks.
Limiting the MAC, ARP, ND list entry can prevent DOS attack.
On port 1/0/1 of SWITCH A, set the max number can be learnt of dynamic MAC
address as 20, dynamic ARP address as 20, NEIGHBOR list entry as 10. In VLAN 1, set
the max number of dynamic MAC address as 30, of dynamic ARP address as 30,
NEIGHBOR list entry as 20.
SWITCH A configuration task sequence:
Switch (config)#interface ethernet 1/0/1
Switch (Config-If-Ethernet1/0/1)#switchport mac-address dynamic maximum 20
Switch (Config-If-Ethernet1/0/1)#switchport arp dynamic maximum 20
Switch (Config-If-Ethernet1/0/1)#switchport nd dynamic maximum 10
Switch (Config-if-Vlan1)#vlan mac-address dynamic maximum 30
SWITCH A
SWITCH B
PC
PC
PC
PC
PC
………