Zte ZXR10 2900E Series - PP Configuration

Chapter5ServiceConguration
5.35PPConguration
PPOverview
ProtocolProtect(PP)maintainsandmonitorstherateofpacketsforwardedtotheCPU,
thuspreventingvirusesorspitefulattackstotheswitch.Inthisway,theswitchprovides
self-protectionabilityandensuresnetworksecurity.
PPtakesthefollowingmeasures:limitingtheratesofrelatedservices,lteringunsuitable
packets,sendingalarmswhentherearepacketssentatanabnormalrate,andreminding
NMSthattheremaybepacketsattackingtheCPU.
Toenhanceexibilityandcompatibilityoftheswitch,PPprovidesthefunctionofconguring
priorityusersfortheprotocolpacketssentbytheswitch.
ConguringPP
ThePPcongurationincludesthefollowingcommands:
CommandFunction
zte(cfg)#createprotocol-protectmac-droprule
<1-128>src-mac<HH.HH.HH.HH.HH.HH>mask
<HH.HH.HH.HH.HH.HH>
Createsamacdroprule.
zte(cfg)#setprotocol-protectalarmport<portlist>{enable|
disable}
EnablesordisablesthePPalarm
functiononaport.
zte(cfg)#setprotocol-protectalarmport<portlist>{protocol-na
me}<0-18000>
SetsPP30second-protocolalarm
threshold.
zte(cfg)#setprotocol-protectlimit{group-name}<0-800>Setstheratelimitofsending
packetstotheCPU.
zte(cfg)#setprotocol-protectpriority{protocol-name|all}{<0-7
>|default}
SetsPPprotocolpriority.
zte(cfg)#setprotocol-protectmac-drop{disable|enable}Enablesthemacdropfunction.
zte(cfg)#setprotocol-protectmac-droprule<1-128>bindport
<portlist>
Bindsthemacdroprulewiththe
port.
zte(cfg)#clearprotocol-protectmac-dropcounter[port
<portlist>]
Clearsthenumberofmessages
droppedbythemacdropfunction.
zte(cfg)#clearprotocol-protectmac-dropport<portlist>[rule
<1-128>]
Clearsthemacdroprulesfor
speciedorallports.
zte(cfg)#clearprotocol-protectmac-droprule[<1-128>]Clearsspeciedmacdroprules.
showprotocol-protectstatistic[port<portlist>](allconguration
modes)
Displaysstatisticsinformationof
protocolpacketalarmsonaPP
port.
showprotocol-protectlimit(allcongurationmodes)DisplaysPPratelimitinformation.
5-133
SJ-20130731155059-002|2013-11-27(R1.0)ZTEProprietaryandCondential