l
URPF blocks packets sent from bogus source addresses.
Local Attack Defense
The Internet technology and size develop quickly and various network applications emerge.
Many enterprises try to boost their own development by using their networks. They are
concerned about how to protect confidential data and resources in an open network environment.
Some unconscious operations may attack network devices and degrade device performance or
even cause device failure.
A large number of packets including valid packets and malicious attack packets on a network
must be processed by devices' CPUs. The malicious attack packets affect services and may even
cause a system breakdown. In addition, excessive normal packets can also lead to high CPU
usage, which degrades the CPUs' performance and interrupts services. Therefore, protecting the
CPU is a necessary and important factor for processing services and system response.
The local attack defense and source tracing functions protect the AR500 against attacks. When
an attack occurs, these functions ensure nonstop service transmission and minimize the impact
of the attack on network services.
PKI
The public key infrastructure (PKI) is a system that generates public keys and digital certificates,
and verifies identities of certificate subjects to ensure information security. PKI issues digital
certificates that bind public keys to respective user identities by means of a certificate authority
(CA).
AAA
The AR500 supports Authentication, Authorization, and Accounting (AAA).
l
Authentication
Verifies users' identities.
l
Authorization
Grants different rights for different users to restrict the services that can be used by users.
l
Accounting
Records information about network service usage of users, including service type, start
time, and traffic volume.
For details about security features, see
Feature Description - Security
.
3.2.5 QoS
Traffic Policing
Traffic policing discards excess traffic to limit the traffic within a specified range and to protect
network resources as well as the carriers' interests.
The AR500 uses committed access rate (CAR) to perform traffic policing. They support dual-
rate-three-color markers and precise bandwidth management.
Huawei AR500 Industrial Switch Routers
Product Description
3 Product Characteristics
Issue 01 (2013-5-10)
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
16