Arp Defense Against Ip Packet Attack Configuration Example - HP A6600 Configuration Manual

ARP defense against IP packet attack configuration example

Network requirements
As shown in
VLAN 20. The two areas connect to the gateway (Device) through an access switch.
A large number of ARP requests are detected in the office area and are considered to be the
consequence of an IP flood attack. To defense against such attacks, configure ARP source suppression
and ARP black hole routing.
Figure 144 Network diagram for configuring ARP defense against IP packet attacks
Configuration considerations
If the attacking packets have the same source address, enable the ARP source suppression function with
the following steps.
Enable ARP source suppression.
1.
Set the threshold for ARP packets from the same source address to 100. If the number of ARP
2.
requests sourced from the same IP address in 5 seconds exceeds 100, the device suppresses the IP
packets sourced from this IP address from triggering any ARP requests within the following 5
seconds.
If the attacking packets have different source addresses, enable the ARP black hole routing function on
the device.
Configuration procedure
ARP source suppression configuration
1.
# Enable ARP source suppression on the device, and set the threshold for ARP packets from the same
source address to 100.
<Device> system-view
[Device] arp source-suppression enable
[Device] arp source-suppression limit 100
Figure 144, a LAN contains two areas: an R&D area in VLAN 10 and an office area in
417