188
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Create an address pool and
enter its view.
ipv6 dhcp pool pool-name
By default, no DHCPv6 address
pools exist.
3.
Apply the address pool to a
VPN instance.
vpn-instance
vpn-instance-name
By default, the address pool is
not applied to any VPN
instance.
Configuring the DHCPv6 server security features
Configuring DHCPv6 flood attack protection
About DHCPv6 flood attack protection
The DHCPv6 flood attack protection enables the DHCPv6 server to detect DHCPv6 flood attacks
according to the DHCPv6 packet rate threshold on a per-MAC basis.
When the DHCPv6 server receives a DHCPv6 packet from a client (MAC address), it creates a
DHCPv6 flood attack entry in check state. If the number of DHCPv6 packets from the same MAC
address reaches the upper limit in the detection duration, the server determines that the client is
launching a DHCPv6 flood attack. The DHCPv6 flood attack entry changes to the restrain state, and
the DHCPv6 server discards the DHCPv6 packets from that client. When the aging time of the entry
is reached, the DHCPv6 server deletes the entry. If a DHCPv6 packet from the MAC address arrives
later, the DHCPv6 server will create a flood attack entry and count the number of incoming DHCPv6
packets for that client again.
This feature is not applicable to a DHCPv6 server if a DHCPv6 relay agent exists in the network. This
is because the MAC address of the DHCPv6 relay agent is encapsulated as the source MAC
address in the DHCPv6 request received by the DHCPv6 server. In this case, you must configure the
feature on the DHCPv6 relay agent. For more information, see "
Configuring DHCPv6 flood attack
If you configure this feature on an interface having no IPv6 address, this feature does not take effect
for packets with multicast destination MAC addresses.
Procedure
To configure DHCPv6 flood attack protection:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enter interface view.
interface interface-type
interface-number
N/A
3.
Enable DHCPv6 flood attack
protection.
ipv6 dhcp flood-protection
enable
By default, DHCPv6 flood attack
protection is disabled.
4.
Return to system view.
quit
N/A
5.
(Optional) Set the DHCPv6
packet rate threshold for
DHCPv6 flood attack
detection.
ipv6 dhcp flood-protection
threshold packet-number
milliseconds
By default, the device allows a
maximum of 6 DHCPv6 packets
per 5000 milliseconds from each
DHCPv6 client.
6.
(Optional) Set the DHCPv6
flood attack entry aging time.
ipv6 dhcp flood-protection
aging-time time
The default setting is 300
seconds.
