Configuring Arp Source Suppression; Enabling Arp Blackhole Routing; Displaying And Maintaining Unresolvable Ip Attack Protection; Configuration Example - HP FlexFabric 5930 Series Security Configuration Manual

ARP source suppression—If the attack packets have the same source address, you can enable the
•
ARP source suppression function, and set the maximum number of unresolvable IP packets that the
device can receive from a host within 5 seconds. If the threshold is reached, the device stops
resolving packets from the host until the 5 seconds elapse.
• ARP blackhole routing—You can enable the ARP blackhole routing function regardless of whether
the attack packets have the same source address. After receiving an unresolvable IP packet, the
device creates a blackhole route destined for that IP address and drops all the matching packets
until the blackhole route ages out.

Configuring ARP source suppression

Step
1. Enter system view.
2. Enable ARP source suppression.
3. Set the maximum number of
unresolvable packets that the
device can receive from a host
within 5 seconds.

Enabling ARP blackhole routing

Step
1. Enter system view.
2. Enable ARP blackhole routing.

Displaying and maintaining unresolvable IP attack protection

Execute display commands in any view.
Task
Display ARP source suppression configuration information.

Configuration example

Network requirements
As shown in
20. Each area connects to the gateway (Device) through an access switch.
A large number of ARP requests are detected in the office area and are considered as the consequence
of an unresolvable IP attack. To prevent such attacks, configure ARP source suppression and ARP
blackhole routing.
Figure 46, a LAN contains two areas: an R&D area in VLAN 10 and an office area in VLAN
Command
system-view
arp source-suppression
enable
arp source-suppression
limit limit-value
Command
system-view
arp resolving-route enable
Command
display arp source-suppression
154
Remarks
N/A
By default, ARP source suppression is
disabled.
By default, the maximum number is 10.
Remarks
N/A
By default, ARP blackhole routing
is enabled.