Supermicro SSE-G2252, User Manual

Page: 878 / 1401

Chapter 24: General Security Measures
Port-based Traffic Segmentation
– 889 –
C
OMMAND
M
ODE
Global Configuration
E
XAMPLE
Console(config)#dos-protection win-nuke 65
Console(config)#
show
dos-protection
This command shows the configuration settings for the DoS protection
commands.
C
OMMAND
M
ODE
Privileged Exec
E
XAMPLE
Console#show dos-protection
Global DoS Protection:
Echo/Chargen Attack : Disabled, 1000 kilobits per second
Smurf Attack : Enabled
TCP Flooding Attack : Disabled, 1000 kilobits per second
TCP Null Scan : Enabled
TCP SYN/FIN Scan : Enabled
TCP/UDP Packets with Port 0 : Enabled
TCP XMAS Scan : Enabled
UDP Flooding Attack : Disabled, 1000 kilobits per second
WinNuke Attack : Disabled, 1000 kilobits per second
Console#
P
ORT
-
BASED
T
RAFFIC
S
EGMENTATION
If tighter security is required for passing traffic from different clients through downlink ports on the local network and over uplink ports to the service provider, port-based traffic segmentation can be used to isolate traffic for individual clients.
Traffic belonging to each client is isolated to the allocated downlink ports.
But the switch can be configured to either isolate traffic passing across a
client’s allocated uplink ports from the uplink ports assigned to other
clients, or to forward traffic through the uplink ports used by other clients,
allowing different clients to share access to their uplink ports where
security is less likely to be compromised.
Table 24-14: Commands for Configuring Traffic Segmentation
Command Function Mode
traffic-segmentation Enables traffic segmentation GC
traffic-segmentation
session
Creates a client session GC
traffic-segmentation
uplink/downlink
Configures uplink/downlink ports for client sessions GC