Zte ZXR10 8900 Series - CPU Attack Protection Principle; Configuring CPU Attack Protection; Configuring Ipv4 Protocol Protection

ZXR108900SeriesUserManual(BasicCongurationVolume)
protocolpacketsattackingCPU.Whensuchalarmappears,disable
protocolprotectionfunctiontoprotectCPUfrombeingattacked.
Note:
AfterprotocolprotectionfunctionsofSNMPandRADIUSaredis-
abled,theyarenotaffectedandworknormally.
ForIPv4andIPv6protocols,thereisathresholdvalue.Bydefault,
thethresholdvalueis3000,thatis,systemallowsreceiving3000
messagesofaprotocolwithin30seconds.Whentherearemore
than3000messagesreceived,alarmappears.Thethresholdvalue
canbecongured.
CPUAttackProtection
Principle
ProtocolprotectionistoprotecttheCPUofaswitch.IfCPUisat-
tackedbymanyprotocolmessages,CPUusageratiowillincrease.
WhenprotocolmessagesaresenttoCPUatahighspeed,protocol
protectionmodulewillcounttheprotocolmessagesofeachtype.
Controlledbyatimer ,thenumberofprotocolmessagessentto
CPUduringacycleiscomparedwithaconguredthresholdvalue.
Forexample,thenumberofprotocolmessagessenttoCPUwithin
30secondsisbiggerthantheconguredthresholdvalue,system
sendsapieceofalarminformationinformatof“Receivetoomany
packetsof’protocolmessagetype’fromport’portnumber’”.This
indicatestheuserthattheremaybeattackofsometypeofproto-
colmessageonaport.Iftheuserconsidersthisisanattack,the
usercandisablethistypeofprotocolprotection.Therefore,this
typeofprotocolmessagescannotbesenttoswitchplatformand
cannotattackCPUanumore.Whentheuserconsidersthatthe
attackstops,theusercanenableprotocolprotectionagainand
normalmessagesofthisprotocolcanbesenttoCPUtobepro-
cessed.
ConfiguringCPUAttack
Protection
ConfiguringIPv4ProtocolProtection
IPv4andIPv6protocolprotectionisconguredininterfacecong-
urationmode.Soitmodiesthisfunctionofphysicalinterfaces.
TocongureIPv4protocolprotection,performthefollowingsteps.
152CondentialandProprietaryInformationofZTECORPORATION