Overview Of Ip Source Guard; Figure 5-1 Diagram Of Ip/Mac Spoofing Attack - Huawei Quidway S9300 Configuration Manual

5 Source IP Attack Defense Configuration

5.1 Overview of IP Source Guard

This section describes the principle of the IP source Guard.
The source IP address spoofing is a common attack on the network, for example, the attacker
forges a valid user and sends IP packets to the server or forges the source IP address of users for
communication. As a result, valid users cannot acquire normal network services. To tackle such
attacks, the S9300 provides the following methods:
l
l
l
IP Source Guard
IP source guard is a measure to filter the IP packets on interfaces. Thus the invalid packets cannot
pass through the interfaces and the security of the interfaces is improved.
The attacker sends a packet carrying the IP address and MAC address of an authorized user to
the server. The server considers the attacker as an authorized user and learns the IP address and
MAC address. The actual user, however, cannot obtain service from the server.
the diagram of IP/MAC spoofing attack.

Figure 5-1 Diagram of IP/MAC spoofing attack

IP:1.1.1.3/24
MAC:3-3-3
To prevent the IP/MAC spoofing attack, you can configure the IP source guard function on the
S9300. Then the S9300 matches the IP packets reaching an interface with the entries in the
binding table. If the packets match entries in the binding table, the packets can pass through the
interface; otherwise, the packets are discarded.
IP Source Trail
The IP source trail function is a policy defending against the DoS attack, which traces the source
of the attack and take corresponding measures after considering it as an attack. In the tracing of
5-2
IP Source Guard
IP Source Trail
URPF (Unicast Reverse Path Forwarding)
DHCP server
IP:1.1.1.2/24
MAC:2-2-2
Attacker
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
IP:1.1.1.1/24
MAC:1-1-1
S9300
IP:1.1.1.3/24
MAC:3-3-3
DHCP client
Quidway S9300 Terabit Routing Switch
Configuration Guide - Security
Figure 5-1
Issue 06 (2010–01–08)
shows