Zte ZXR10 8900E series, Описание продукта

Страница: 76 / 132

ZXR10 8900E series Core Switch Product Description
66 © 2013ZTE CORPORATION. All rights reserved. ZTE Confidential Proprietary
3.8.5 Network Security
Ideally, user-class virus inspection which requires user to install patch and anti-virus
software is preffered in defending network virus. In most occasions, lots of users can not
accomplish this task, so switch must be able to provide network-class virus inspection
and alarm.
Besides, for some malicious network attacks, the switch must have some protective
mechanisms to avoid the breakdown of the switch and network. ZXR10 8900E series
switch mainly realizes network-based security mechanism. It configure security
inspection service to different units.
In ZXR10 8900E series switch, the network security mainly includes the following
services:
Inspect virus which cause outbreak traffic increase, e.g. “SQL worm”, “red code” and
“shockwave”. Corresponding alarms will be generated, or the client port will be closed.
Avoid user’s ARP proofing.
MAC address flooding protection. Restrict port MAC address number.
Set port broadcasting packet threshold.
L2, L3 and L4 hybrid ACL filtering.
Route filtering
Forbid ICMP relocation service. Prevent attacker from sending spoofing ICMP message.

Defend CPU attack. Implement protocol message protection. Distribute different
hardware CPU queue to protocol message. Set precedence, speed restriction, wred
and other QoS mechanisms. Protect CPU.

Defend DoS attack based upon hardware queue. Support anti-land | null-scan |
ping-of-death | smurf | sys-fin | syn-port-less-1024 | xma-scan | ping-flood |
syn-flood attack. Anti-ping-flood | syn-flood attack can support speed restriction.

Anti-IPv4 URPF source address deception.

Automatic broadcasting storm suppression.

Control/signaling MD5 encryption authentication

DHCP snooping

IP Source guard and DAI based upon DHCP Snooping.

IPv6 ND security