HP 12500 Series Configuration Manual page 8

Configuration procedure ···································································································································· 244
Verifying the configuration ································································································································· 244
Configuring TCP and ICMP attack protection ······································································································· 246
Overview ······································································································································································· 246
Enabling the SYN Cookie feature ······························································································································ 246
Enabling protection against Naptha attacks ············································································································· 247
Disabling forwarding ICMP fragments ······················································································································ 248
Displaying and maintaining TCP and ICMP attack protection ················································································ 248
Configuring IP source guard ·································································································································· 249
Overview ······································································································································································· 249
Static IP source guard entries ····························································································································· 249
Dynamic IP source guard entries ······················································································································· 250
IP source guard configuration task list ······················································································································· 250
Configuring the IPv4 source guard function ·············································································································· 251
Configuring IPv4 source guard on a port ········································································································· 251
Configuring a static IPv4 source guard entry ··································································································· 252
Setting the maximum number of IPv4 source guard entries ············································································ 252
Configuring the IPv6 source guard function ·············································································································· 253
Configuring IPv6 source guard on a port ········································································································· 253
Configuring a static IPv6 source guard entry ··································································································· 254
Setting the maximum number of IPv6 source guard entries ············································································ 255
Displaying and maintaining IP source guard ············································································································ 255
IP source guard configuration examples ··················································································································· 257
Static IPv4 source guard entry configuration example ···················································································· 257
Dynamic IPv4 source guard by DHCP snooping configuration example ······················································ 259
Dynamic IPv4 source guard by DHCP relay configuration example ····························································· 260
Static IPv6 source guard entry configuration example ···················································································· 261
Dynamic IPv6 source guard by DHCPv6 snooping configuration example ················································· 262
Dynamic IPv6 source guard by ND snooping configuration example ·························································· 263
Troubleshooting IP source guard ································································································································ 264
Neither static binding entries nor the dynamic binding function can be configured ··································· 264
Configuring ARP attack protection ························································································································· 265
Overview ······································································································································································· 265
ARP attack protection configuration task list ············································································································· 265
Configuring ARP defense against IP packet attacks ································································································· 266
Introduction ·························································································································································· 266
Configuring ARP source suppression ················································································································ 266
Enabling ARP black hole routing ······················································································································· 266
Displaying and maintaining ARP defense against IP packet attacks ····························································· 267
Configuring ARP packet rate limit ······························································································································ 267
Introduction ·························································································································································· 267
Configuration procedure ···································································································································· 267
Configuring source MAC address based ARP attack detection ············································································· 267
Displaying and maintaining source MAC address based ARP attack detection ·········································· 268
Configuring ARP packet source MAC address consistency check ········································································· 269
Introduction ·························································································································································· 269
Configuration procedure ···································································································································· 269
Configuring ARP active acknowledgement ··············································································································· 269
Introduction ·························································································································································· 269
Configuration procedure ···································································································································· 269
Configuring authorized ARP ······································································································································· 270
Introduction ·························································································································································· 270
Configuration procedure ···································································································································· 270
vi