Zte ZXR10 5900 Series - Page 189

Chapter17SecurityConguration
isdifferentaccordingtodifferentprotocolpackets,whichcan
beviewedbyshowcommand.
3.Tocongureprotocolpacketalarmthreshold,usethefollowing
command.
CommandFunction
ZXR10(config-gei_1/x)#protocol-protectalarmmode
<protocolname><alarm-limit>
Thisconguresacertain
protocolpacketalarmthreshold
as30s.
Thealarm-limitrangeis
1000-18000.
Thiscommandisalsoconguredintheinterfacemode.Itis
usedtomodifyacertainprotocolpacketalarmthresholdin
acertainphysicalport.Whenthenumberofspecicprotocol
packetexceedsthisthresholdin30s,analarmmessageissent
touser .Thedefaultvalueis3000.
4.Tocongureprotocolpacketpassingpeak/averagespeed,use
thefollowingcommand.
CommandFunction
ZXR10(config-gei_1/x)#protocol-protect{peak-rate|
average-rate}mode<protocolname><rate-limit>
Thisconguresprotocolpacket
passingpeak/averagespeed.
Thiscommandisusedtocongurepeakspeedoraverage
speedofcorrespondingprotocolpacketoncorrespondingport.
Theunitispps,peakspeedcanbecongured100~1000and
thedefaultvalueis300,averagespeedcanbeset10~600and
thedefaultis100.
5.Tocongureporttype,usethefollowingcommand.
CommandFunction
ZXR10(config-gei_1/x)#protocol-protecttype{nni|uni}
Thisconguresthetypeofa
certainportisuniornni.
Thiscommandisusedtocongureacertainporttypewhichis
uniornni.Thedefaultisnni.
Theabovecommandssupportingprotocolincludes:
pimigmpicmparpreplyarprequestudld,groupmngvbaselldp,
dhcplacpbpdusnmp,nansrars.
Whenprotocolpacketiscongureddiscard,evenifuploadedto
MUXmodule,itwillbediscardedbythismodule,whichleadsto
failtouploadtoplatform.Whencontrol-plane-securitymod-
ulendthatthespeedofacertainprotocolpacketuploading
toplatformistoofast,itwillsendalarmtoreminduserthat
maybethereisacertainprotocolpackettoattackCPU.When
seeingthisalarm,usercancongureprotocolpacketdiscard
orlimitspeedtopreventattackfromCPU.
CondentialandProprietaryInformationofZTECORPORATION175