H3C S5500-SI Series, Operation Manual

Page: 796 / 1217

1-2
Task Remarks
Configuring Source MAC Address Based
ARP Attack Detection
Optional
Configure this function on gateways
(recommended).
Configuring ARP Packet Source MAC
Address Consistency Check
Optional
Configure this function on gateways
(recommended).
Configuring ARP Active Acknowledgement
Optional
Configure this function on gateways
(recommended).
Configuring ARP Detection
Optional
Configure this function on access
devices (recommended).
Configuring ARP Automatic Scanning and
Fixed ARP
Optional
Configure this function on gateways
(recommended).
Configuring ARP Gateway Protection
Optional
Configure this function on access
devices (recommended).
User and
gateway
spoofing
prevention
Configuring ARP Filtering
Optional
Configure this function on access
devices (recommended).
Configuring ARP Defense Against IP Packet Attacks
Introduction
If a device receives large numbers of IP packets from a host to unreachable destinations,
z
The device sends large numbers of ARP requests to the destination subnets, which increases the
load of the destination subnets.
z
The device keeps trying to resolve destination IP addresses, which increases the load of the CPU.
To protect the device from IP packet attacks, you can enable the ARP source suppression function or
ARP black hole routing function.
If the packets have the same source address, you can enable the ARP source suppression function.
With the function enabled, whenever the number of ARP requests triggered by the packets with
unresolvable destination IP addresses from a host within five seconds exceeds a specified threshold,
the device suppresses the sending host from triggering any ARP requests within the following five
seconds.
If the packets have various source addresses, you can enable the ARP black hole routing function.
After receiving an IP packet whose destination IP address cannot be resolved by ARP, the device with
this function enabled immediately creates a black hole route and simply drops all packets matching the
route during the aging time of the black hole route.