H3C SR6600 Series, Часто задаваемые вопросы

Страница: 14 / 22

10
Q. Why doesn't the running configuration on a reunified IRF fabric include the configuration that I made
on one chassis after an IRF split?
A. When an IRF fabric merges, the chassis in the Recovery-state IRF fabric reboots with the running
configuration on the active IRF fabric. The configuration you made on the recovery IRF fabric will not
take effect.
Network security and attack prevention
This section contains the most frequently asked questions about network security and attack
prevention.
Q. What attack prevention types does the router support?
A. The router supports protection against ARP, network layer, and transport layer attacks, as shown
in
Table 2 .
Table 2 Attack prevention types
Attack prevention types Description
ARP attack
ARP source suppression Prevents IP attack packets from fixed sources.
ARP black hole routing Prevents IP attack packets from sources that are not fixed.
ARP active
acknowledgement
Prevents user spoofing.
Source MAC-based ARP
attack detection
Prevents ARP packet attacks from the same source MAC.
ARP packet source MAC
consistency check
Prevents attacks from ARP packets whose source MAC
address in the Ethernet header is different from the sender
MAC address in the message body.
Network layer
uRPF check Protects a network against source spoofing attacks.
TTL attack prevention
Prevents an attack by disabling sending ICMP time
exceeded messages.
Transport layer
SYN flood attack
prevention
Enables the server to directly return a SYN ACK message
upon receiving a TCP connection request, without
establishing a half-open TCP connection.
Q. Does the router support local authentication before RADIUS authentication?
A. No. Local authentication can be performed only when no response is received from the RADIUS
server.
Q. Why cannot a user log in to an ACS authentication server through a console port when the router
uses RADIUS authentication?
A. The user can log in to an ACS server through a console port only when you clear the Login-Service
option for the ACS server configuration.
Q. Why can the level for the RADIUS server (the router) only be 1 when it connects to an ACS server?
A. The symptom might occur when one of the following conditions exists:
•
The 2011/002 private attributes for the ACS server are not complete.
•
The Login-Service attribute for the ACS server is not configured.