Table of Contents
Advertisement
Step
1.
Enter system view.
2.
Create an address pool and
enter its view.
3.
Apply the address pool to a
VPN instance.
Configuring the DHCPv6 server security features
Configuring DHCPv6 flood attack protection
About DHCPv6 flood attack protection
The DHCPv6 flood attack protection enables the DHCPv6 server to detect DHCPv6 flood attacks
according to the DHCPv6 packet rate threshold on a per-MAC basis.
When the DHCPv6 server receives a DHCPv6 packet from a client (MAC address), it creates a
DHCPv6 flood attack entry in check state. If the number of DHCPv6 packets from the same MAC
address reaches the upper limit in the detection duration, the server determines that the client is
launching a DHCPv6 flood attack. The DHCPv6 flood attack entry changes to the restrain state, and
the DHCPv6 server discards the DHCPv6 packets from that client. When the aging time of the entry
is reached, the DHCPv6 server deletes the entry. If a DHCPv6 packet from the MAC address arrives
later, the DHCPv6 server will create a flood attack entry and count the number of incoming DHCPv6
packets for that client again.
This feature is not applicable to a DHCPv6 server if a DHCPv6 relay agent exists in the network. This
is because the MAC address of the DHCPv6 relay agent is encapsulated as the source MAC
address in the DHCPv6 request received by the DHCPv6 server. In this case, you must configure the
feature on the DHCPv6 relay agent. For more information, see
protection."
If you configure this feature on an interface having no IPv6 address, this feature does not take effect
for packets with multicast destination MAC addresses.
Procedure
To configure DHCPv6 flood attack protection:
Step
1.
Enter system view.
2.
Enter interface view.
3.
Enable DHCPv6 flood attack
protection.
4.
Return to system view.
5.
(Optional) Set the DHCPv6
packet rate threshold for
DHCPv6 flood attack
detection.
6.
(Optional) Set the DHCPv6
flood attack entry aging time.
Command
system-view
ipv6 dhcp pool pool-name
vpn-instance vpn-instance-name
Command
system-view
interface interface-type
interface-number
ipv6 dhcp flood-protection
enable
quit
ipv6 dhcp flood-protection
threshold packet-number
milliseconds
ipv6 dhcp flood-protection
aging-time time
188
Remarks
N/A
By default, no DHCPv6 address
pools exist.
By default, the address pool is
not applied to any VPN
instance.
"Configuring DHCPv6 flood attack
Remarks
N/A
N/A
By default, DHCPv6 flood attack
protection is disabled.
N/A
By default, the device allows a
maximum of 6 DHCPv6 packets
per 5000 milliseconds from each
DHCPv6 client.
The default setting is 300
seconds.
Advertisement
Table of Contents
Troubleshooting
