manualshive.com logo in svg

H3C S12500R Series, Configuration Examples

Share
Download
H3C S12500R Series Configuration Examples Download Page 6

 

4 

[DeviceA] interface range hundredgige 1/0/1 to hundredgige 1/0/3 

[DeviceA-if-range] port link-mode bridge 

[DeviceA-if-range] quit 

# Configure STP BPDU guard. 

[DeviceA] stp bpdu-protection 

# Configure HundredGigE 1/0/3 as an edge port. 

[DeviceA] interface hundredgige 1/0/3 

[DeviceA-HundredGigE1/0/3] stp edged-port 

[DeviceA-HundredGigE1/0/3] quit 

# Configure TC-BPDU guard. 

[DeviceA] stp tc-protection 

[DeviceA] stp tc-protection threshold 10 

# Configure broadcast and multicast suppression on all ports. 

[DeviceA] interface range hundredgige 1/0/1 to hundredgige 1/0/3 

[DeviceA-if-range] broadcast-suppression pps 6400 

[DeviceA-if-range] multicast-suppression pps 6400 

[DeviceA-if-range] quit 

Configuring Device C 

# Specify IP addresses for interfaces. (Details not shown.) 

# Configure each interface to operate in Later 2 mode. 

<DeviceC> system-view 

[DeviceC] interface range hundredgige 1/0/1 to hundredgige 1/0/3 

[DeviceC-if-range] port link-mode bridge 

[DeviceC-if-range] quit 

# Configure STP BPDU guard. 

[DeviceC] stp bpdu-protection 

# Configure HundredGigE 1/0/3 as an edge port. 

[DeviceC] interface hundredgige 1/0/3 

[DeviceC-HundredGigE1/0/3] stp edged-port 

[DeviceC-HundredGigE1/0/3] quit 

# Configure loop guard on HundredGigE 1/0/2. 

[DeviceC] interface hundredgige 1/0/2 

[DeviceC-HundredGigE1/0/2] stp loop-protection 

[DeviceC-HundredGigE1/0/2] quit 

# Configure TC-BPDU guard. 

[DeviceC] stp tc-protection 

[DeviceC] stp tc-protection threshold 10 

# Configure broadcast and multicast suppression on all ports. 

[DeviceC] interface range hundredgige 1/0/1 to hundredgige 1/0/3 

[DeviceC-if-range] broadcast-suppression pps 6400 

[DeviceC-if-range] multicast-suppression pps 6400 

[DeviceC-if-range] quit 

Summary of Contents for S12500R Series

Page 1: ... manual may be reproduced or transmitted in any form or by any means without prior written consent of New H3C Technologies Co Ltd Except for the trademarks of New H3C Technologies Co Ltd any trademarks that may be mentioned in this document are the property of their respective owners The information in this document is subject to change without notice ...

Page 2: ... ARP attack protection 6 Network configuration 6 Software versions used 7 Procedures 7 Verifying the configuration 7 Configuration files 8 Example Configuring network layer attack protection 8 Network configuration 8 Software versions used 8 Restrictions and guidelines 9 Procedures 9 Verifying the configuration 9 Configuration files 9 Example Configuring transport layer attack protection 10 Networ...

Page 3: ...ng Source MAC based ARP attack detection Prevents ARP packet attacks from the same source MAC ARP packet source MAC consistency check Prevents attacks from ARP packets whose source MAC address in the Ethernet header is different from the sender MAC address in the message body Network layer attack protection uRPF check Protects a network against source spoofing attacks TTL attack protection Prevent...

Page 4: ... at the access side of Device A and Device C The BPDU guard feature prevents the ports from performing spanning tree calculations when it receives forged BPDUs with a higher priority Enable TC BPDU guard on Device A Device B and Device C The TC BPDU guard feature prevents a large number of TC BPDUs from affecting the network in a short time Configure broadcast and multicast suppression on the desi...

Page 5: ...dministratively Down state To have an interface operate you must use the undo shutdown command to enable that interface Procedures Configuring Device B Specify IP addresses for interfaces Details not shown Configure root guard on HundredGigE 1 0 1 and HundredGigE 1 0 2 DeviceB system view DeviceB interface range hundredgige 1 0 1 to hundredgige 1 0 2 DeviceB if range port link mode bridge DeviceB ...

Page 6: ...terfaces Details not shown Configure each interface to operate in Later 2 mode DeviceC system view DeviceC interface range hundredgige 1 0 1 to hundredgige 1 0 3 DeviceC if range port link mode bridge DeviceC if range quit Configure STP BPDU guard DeviceC stp bpdu protection Configure HundredGigE 1 0 3 as an edge port DeviceC interface hundredgige 1 0 3 DeviceC HundredGigE1 0 3 stp edged port Devi...

Page 7: ... flooded after a large number of broadcasts are sent to the edge ports on device A and Device C Details not shown Configuration files Device A stp bpdu protection stp tc protection threshold 10 interface HundredGigE 1 0 1 port link mode bridge broadcast suppression pps 6400 multicast suppression pps 6400 interface HundredGigE 1 0 2 port link mode bridge broadcast suppression pps 6400 multicast sup...

Page 8: ...dredGigE 1 0 2 port link mode bridge stp loop protection broadcast suppression pps 6400 multicast suppression pps 6400 interface HundredGigE 1 0 3 port link mode bridge stp edged port broadcast suppression pps 6400 multicast suppression pps 6400 Example Configuring ARP attack protection Network configuration As shown in Figure 2 the device is the gateway for the internal network Configure ARP atta...

Page 9: ... packet attacks Device arp resolving route enable Enable ARP active acknowledgment to prevent user spoofing Device arp active ack enable Configure source MAC based ARP attack detection to prevent ARP packet attacks from the same source MAC Device arp source mac filter Device arp source mac threshold 25 Enable ARP packet source MAC address consistency check to prevent attacks from ARP packets with ...

Page 10: ...alid check enable arp source mac filter arp source mac threshold 25 arp active ack enable arp source suppression enable arp source suppression limit 8 Example Configuring network layer attack protection Network configuration As shown in Figure 3 Device A is the gateway for the internal network To protect Device A against IP packet attacks from internal and external networks configure the following...

Page 11: ...Device A can filter out packets with forged source IP addresses Details not shown Verify the uRPF configuration DeviceA display ip urpf Global uRPF configuration information Check type strict 2 Verify that TTL attack protection functions on Device A Enable ICMP debugging by executing the debugging ip icmp command on Device A Details not shown Use a PC to send packets in which the TTL is 1 to Devic...

Page 12: ... on the device are disabled in ADM or Administratively Down state To have an interface operate you must use the undo shutdown command to enable that interface Procedures Specify IP addresses for interfaces Details not shown Enable SYN Cookie Device system view Device tcp syn cookie enable Verifying the configuration Verify that the device does not have any TCP semi connections The state SYN_RECEIV...

Page 13: ...Command Reference R3606 H3C S12500R Switch Router Series Layer 2 LAN Switching Configuration Guide R3606 H3C S12500R Switch Router Series Layer 3 IP Services Command Reference R3606 H3C S12500R Switch Router Series Layer 3 IP Services Configuration Guide R3606 H3C S12500R Switch Router Series Security Command Reference R3606 H3C S12500R Switch Router Series Security Configuration Guide R3606 ...

Reviews:

No comments

Brands by name

Popular brands

Load more brands