Command Manual - Security
Quidway S3500 Series Ethernet Switches Chapter 6 System-guard Configuration Commands
Huawei Technologies Proprietary
6-5
6.1.5 system-guard detect-threshold
Syntax
system-guard detect-threshold IP-record-threshold record-times-threshold
isolate-time
undo system-guard detect-threshold
View
System view
Parameter
IP-record-threshold; the max number of the learned IP addresses, range from 1 to 100.
record-times-threshold: threshold of consecutive detection times which the learned
address number exceed the threshold of IP address learned for one time ,range from 1
to 10.
isolate-time: isolate time, range from 3 to 100, unit in aging period.
Description
Using system-guard detect-threshold command, you can set IP-record-threshold,
record-times-threshold, isolate-time of system-guard function. Using undo
system-guard detect-threshold, you can restore these three parameters to the
default values.
By default, IP-record-threshold, record-times-threshold, isolate-time of system-guard
function are 30, 1 and 3.
For example, set the IP-record-threshold, record-times-threshold, isolate-time of
system-guard function to 50, 3, 5. In this case, the system will consider to be attacked
and not learn the destination IP address of the packet from source IP address for 5
times of aging period if the number of the IP packets (not destined to the switch) the
system detected from one source IP address exceed 50 for consecutive 3 times.
Example
# Set the IP-record-threshold, record-times-threshold, isolate-time of system-guard
function to 50, 3, 5
[Quidway] system-guard detect-threshold 50 3 5
6.1.6 system-guard no-learn-dip enable
Syntax
system-guard no-learn-dip enable
undo system-guard no-learn-dip enable
To Next Page
Loading...
Need help?
General
