Enabling invalid spi recovery, Setting the maximum number of ike sas, Configuring arp source suppression – H3C Technologies H3C S12500-X Series Switches User Manual
Page 229: Enabling arp blackhole routing, Configuration example

217
•
ARP source suppression—Stops resolving packets from a host if the upper limit on unresolvable IP
packets from the host is reached within an interval of 5 seconds. The device continues ARP
resolution when the interval elapses. This feature is applicable if the attack packets have the same
source addresses.
•
ARP blackhole routing—Creates a blackhole route destined for an unresolvable IP address. The
device drops all matching packets until the blackhole route ages out. This feature is applicable
regardless of whether the attack packets have the same source addresses.
298B
Configuring ARP source suppression
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enable ARP source suppression.
arp source-suppression
enable
By default, ARP source suppression is
disabled.
3.
Set the maximum number of
unresolvable packets that the
device can receive from a host
within 5 seconds.
arp source-suppression
limit limit-value
By default, the maximum number is 10.
299B
Enabling ARP blackhole routing
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enable ARP blackhole routing.
arp resolving-route enable
By default, ARP blackhole routing
is enabled.
300B
Displaying and maintaining unresolvable IP attack protection
Execute display commands in any view.
Task Command
Display ARP source suppression configuration information. display arp source-suppression
301B
Configuration example
526B
Network requirements
As shown in
930H
Figure 68
, a LAN contains two areas: an R&D area in VLAN 10 and an office area in VLAN
20. Each area connects to the gateway (Device) through an access switch.
A large number of ARP requests are detected in the office area and are considered as the consequence
of an unresolvable IP attack. To prevent such attacks, configure ARP source suppression and ARP
blackhole routing.
- H3C S5560 Series Switches H3C WX6000 Series Access Controllers H3C WX5000 Series Access Controllers H3C WX3000 Series Unified Switches H3C LSWM1WCM10 Access Controller Module H3C LSWM1WCM20 Access Controller Module H3C LSQM1WCMB0 Access Controller Module H3C LSRM1WCM2A1 Access Controller Module H3C LSBM1WCM2A0 Access Controller Module H3C S9800 Series Switches H3C S5130 Series Switches H3C S5120 Series Switches