HP 1820, Management And Configuration Manual

Page: 84 / 110

9-2
Security
Advanced Security Configuration
Figure 9-1. Advanced Security Configuration Page
Table 9-1. Advanced Security Configuration Fields
Field Description
Storm Control Features
Storm Control Storm control enables the rate-limiting of incoming unicast (with unknown destination), multicast,
and broadcast traffic to prevent unnecessary congestion in the network. When enabled, the storm
control threshold is automatically set to 5% of port speed. If the incoming rate of unicast (with
unknown destination), multicast, or broadcast packets exceeds this value, the port discards the excess
traffic until the rate for that particular packet type falls below the threshold.
Note : The threshold percentage is translated to a packets-per-second value that is used by the switch
hardware to rate-limit the incoming traffic. This translation assumes a nominal 512 byte packet size
to determine the packets-per-second threshold based on the port speed. For example, the 5% threshold
applied to a 1 Gbps port equates to approximately 11748 packets-per-second, regardless of the actual
packet sizes being received by the port. Each of the three storm control packet types is rate-limited
independently.
Auto Dos Features
Auto DoS Enable this option to enable all the DoS prevention mechanisms with default values. Enabling this
feature makes all the fields in the remainder of the table inaccessible (grayed-out). When disabled,
you can individually turn on and off the DoS features and change their default values. This feature
and all the individual DoS protections are disabled by default.
Prevent Land
Attack
Enable this option to drop packets for which the source IP address equals the destination IP address.
Prevent TCP
Blat Attack Enable this option to drop packets for which the TCP source port equals the TCP destination port.
Prevent UDP
Blat Attack Enable this option to drop packets that have a UDP source port equal to the UDP destination port.
Prevent Invalid
TCP Flags
Attack
Enable this option to drop packets that have TCP Flags SYN and FIN set.