Huawei AR1200-S - Checking the Configuration

destination-unreachable packets. This helps reduce the burden on the AR1200-S and protect
CPU resources.
Procedure
Step 1 Run:
system-view
The system view is displayed.
Step 2 Run:
icmp unreachable drop
The AR1200-S is enabled to discard ICMP destination-unreachable packets.
By default, the AR1200-S does not discard ICMP destination-unreachable packets.
----End
7.4.5 Checking the Configuration
After configuring the AR1200-S to discard specified ICMP packets, you can use the following
commands to verify the configuration.
Procedure
l Run the display current-configuration command to check whether the AR1200-S is
configured to discard specified ICMP packets.
----End
Example
# Run the display current-configuration | include icmp command to check whether the
AR1200-S is configured to discard specified ICMP packets.
<Huawei> display current-configuration | include icmp
icmp unreachable drop
icmp ttl-exceeded drop
icmp with-options drop
7.5 Disabling the AR1200-S from Sending Destination-
Unreachable Packets
This section describes how to disable the AR1200-S from sending destination-unreachable
packets.
Applicable Environment
The AR1200-S can be disabled from sending destination-unreachable packets, including host-
unreachable packets and port-unreachable packets. If an attacker sends a large number of
destination-unreachable packets to attack the AR1200-S, the AR1200-S does not respond to
these packets and discards them directly to protect CPU resources.
Huawei AR1200-S Series Enterprise Routers
Configuration Guide - Security 7 ICMP Security Configuration
Issue 02 (2012-03-30) Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
155