HP 3600 v2 Series Configuration Manual page 11

Configuring TCP attack protection ························································································································· 352
Overview ······································································································································································· 352
Enabling the SYN Cookie feature ······························································································································ 352
Configuring TCP fragment attack protection ············································································································· 353
Displaying and maintaining TCP attack protection ·································································································· 353
Configuring IP source guard ·································································································································· 354
Overview ······································································································································································· 354
Static IP source guard binding entries ··············································································································· 354
Dynamic IP source guard binding entries ········································································································· 355
Configuration task list ·················································································································································· 355
Configuring the IPv4 source guard feature ··············································································································· 356
Configuring IPv4 source guard on an interface ······························································································· 356
Configuring a static IPv4 source guard binding entry····················································································· 357
Setting the maximum number of IPv4 source guard binding entries ····························································· 358
Configuring the IPv6 source guard feature ··············································································································· 359
Configuring IPv6 source guard on an interface ······························································································· 359
Configuring a static IPv6 source guard binding entry····················································································· 360
Setting the maximum number of IPv6 source guard binding entries ····························································· 361
Displaying and maintaining IP source guard ············································································································ 361
IP source guard configuration examples ··················································································································· 362
Static IPv4 source guard configuration example ····························································································· 362
Dynamic IPv4 source guard using DHCP snooping configuration example ················································· 364
Dynamic IPv4 source guard using DHCP relay configuration example ························································ 365
Static IPv6 source guard configuration example ····························································································· 366
Dynamic IPv6 source guard using DHCPv6 snooping configuration example ············································· 367
Dynamic IPv6 source guard using ND snooping configuration example ····················································· 368
Global static IP source guard configuration example ····················································································· 369
Troubleshooting IP source guard ································································································································ 371
Configuring ARP attack protection ························································································································· 372
Overview ······································································································································································· 372
ARP attack protection configuration task list ············································································································· 372
Configuring ARP defense against IP packet attacks ································································································· 373
Configuring ARP source suppression ················································································································ 373
Enabling ARP black hole routing ······················································································································· 374
Displaying and maintaining ARP defense against IP packet attacks ····························································· 374
Configuration example ······································································································································· 374
Configuring ARP packet rate limit ······························································································································ 376
Introduction ·························································································································································· 376
Configuration procedure ···································································································································· 376
Configuring source MAC address based ARP attack detection ············································································· 377
Configuration procedure ···································································································································· 377
Displaying and maintaining source MAC address based ARP attack detection ·········································· 378
Configuration example ······································································································································· 378
Configuring ARP packet source MAC address consistency check ········································································· 379
Introduction ·························································································································································· 379
Configuration procedure ···································································································································· 379
Configuring ARP active acknowledgement ··············································································································· 379
Introduction ·························································································································································· 379
Configuration procedure ···································································································································· 380
Configuring ARP detection ·········································································································································· 380
Introduction ·························································································································································· 380
Configuring user validity check ························································································································· 380
Configuring ARP packet validity check ············································································································· 381
ix