System Guard Configuration; System Guard Overview; Guard Against Ip Attacks; Guard Against Tcn Attacks - H3C S5600 SERIES Operation Manual

4

System Guard Configuration

When configuring System Guard, go to these sections for information you are interested in:

System Guard Overview

Configuring System Guard

Displaying and Maintaining System Guard Configuration
System Guard Overview

Guard Against IP Attacks

System-guard operates to inspect the IP packets over 10-second intervals for the CPU for suspicious
source IP addresses. Once the packets from such an IP address hit the predefined threshold, System
Guard does one of the following:
The switch logs out the host (hereafter referred to as infected host) by automatically applying an
ACL rule and waits a certain period of time before resuming forwarding packets for that host.
If the packets from the infected host need processing by the CPU, the switch decreases the
precedence of such packets and discards the packets already delivered to the CPU.

Guard Against TCN Attacks

System Guard monitors the rate at which TCN/TC packets are received on the ports. If a port receives
an excessive number of TCN/TC packets within a given period of time, the switch sends only one
TCN/TC packet in every 10 seconds to the CPU and discards the rest TCN/TC packets, while outputting
trap and log information.

Layer 3 Error Control

With the Layer 3 error control feature enabled, the switch delivers all Layer 3 packets that the switch
considers to be error packets to the CPU.
Configuring System Guard

Configuring System Guard Against IP Attacks

Configuration of System Guard against IP attacks includes these tasks:
Enabling System Guard against IP attacks
Setting the maximum number of infected hosts that can be concurrently monitored
Configuring parameters related to MAC address learning
Follow these steps to configure System Guard against IP attacks:
To do...
Enter system view
Use the command...
system-view
4-1
Remarks
—