6.5.1 Establishing the Configuration Task.....................................................................................................136
6.5.2 Configuring Source IP Address-based ARP Packet Suppression.........................................................137
6.5.3 Configuring Rate Limit of ARP Packets...............................................................................................138
6.5.4 Configuring Source IP Address-based ARP Miss Packet Suppression.................................................139
6.5.5 Configuring Rate Limiting of ARP Miss Packets.................................................................................140
6.5.6 Configuring Source MAC Address-based ARP Packet Suppression....................................................140
6.5.7 Setting the Aging Time of Fake ARP Entries.......................................................................................141
6.5.8 (Optional) Setting the Rate Limit of Broadcasting ARP Packets on the VLANIF Interface of a Super-
VLAN.............................................................................................................................................................142
6.5.9 Checking the Configuration...................................................................................................................142
6.6 Maintaining ARP Security..............................................................................................................................143
6.6.1 Displaying the Statistics on ARP Packets.............................................................................................143
6.6.2 Clearing the Statistics on ARP Packets.................................................................................................143
6.6.3 Clearing the Statistics on Discarded ARP Packets................................................................................144
6.7 Configuration Examples.................................................................................................................................144
6.7.1 Example for Configuring ARP Security Functions...............................................................................144
7 ICMP Security Configuration.................................................................................................150
7.1 ICMP Security Overview...............................................................................................................................151
7.2 ICMP Security Features Supported by the AR1200-S...................................................................................151
7.3 Limiting the Rate of ICMP Packets................................................................................................................151
7.4 Configuring the AR1200-S to Discard Specified ICMP Packets...................................................................153
7.4.1 Establishing the Configuration Task.....................................................................................................153
7.4.2 Configuring the AR1200-S to Discard the ICMP Packets with TTL Value of 1..................................153
7.4.3 Configuring the AR1200-S to Discard the ICMP Packets with Options..............................................154
7.4.4 Configuring the AR1200-S to Discard ICMP Destination-Unreachable Packets.................................154
7.4.5 Checking the Configuration...................................................................................................................155
7.5 Disabling the AR1200-S from Sending Destination-Unreachable Packets....................................................155
7.6 Maintaining ICMP Security............................................................................................................................156
7.7 Configuration Examples.................................................................................................................................157
7.7.1 Example for Disabling the AR1200-S from Sending Host-Unreachable Packets.................................157
7.7.2 Example for Optimizing System Performance by Discarding Certain ICMP Packets..........................159
8 IP Address Anti-spoofing Configuration.............................................................................162
8.1 IP Address Anti-spoofing Overview..............................................................................................................163
8.2 IP Source Address-based Attack Defense Features Supported by the AR1200-S.........................................163
8.3 Configuring URPF..........................................................................................................................................164
8.4 Configuration Examples.................................................................................................................................165
8.4.1 Example for Configuring URPF............................................................................................................165
9 Local Attack Defense Configuration.....................................................................................168
9.1 Local Attack Defense Overview.....................................................................................................................169
9.2 Local Attack Defense Features Supported by the AR1200-S........................................................................169
9.3 Configuring Attack Source Tracing...............................................................................................................170
9.4 Configuring CPU Attack Defense..................................................................................................................172
Huawei AR1200-S Series Enterprise Routers
Configuration Guide - Security Contents
Issue 02 (2012-03-30) Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
ix
To Next Page
Loading...
