Enabling Client Offline Detection; Configuring Dhcpv6 Flood Attack Protection - H3C SR8800-F Configuration Manual

Step
1. Enter system view.
2. Enter interface view.
3. Enable IPv6 release
notification.

Enabling client offline detection

This feature enables the DHCPv6 relay agent to detect the status of ND entries. After an ND entry
ages out, the DHCPv6 relay agent considers the client offline and deletes the relay entry for the client.
For more information about ND, see Layer 3—IP Services Configuration Guide.
To enable client offline detection:
Step
1. Enter system view.
2. Enter interface view.
3. Enable client offline detection.

Configuring DHCPv6 flood attack protection

The DHCPv6 flood attack protection enables the DHCPv6 relay agent to detect DHCPv6 flood
attacks according to the DHCPv6 packet rate threshold on a per-MAC basis.
When the DHCPv6 relay agent receives a DHCPv6 packet from a client (MAC address), it creates a
DHCPv6 flood attack entry in check state. If the number of DHCPv6 packets from the same MAC
address reaches the upper limit in the detection duration, the relay agent determines that the client is
launching a DHCPv6 flood attack. The DHCPv6 flood attack entry changes to the restrain state, and
the DHCPv6 relay agent discards the DHCPv6 packets from that client. When the aging time of the
entry is reached, the DHCPv6 relay agent deletes the entry. If a DHCPv6 packet from the MAC
address arrives later, the DHCPv6 relay agent will create a flood attack entry and count the number
of incoming DHCPv6 packets for that client again.
To configure DHCPv6 flood attack protection:
Step
1. Enter system view.
2. (Optional) Set the DHCPv6
packet rate threshold for
DHCPv6 flood attack
detection.
3. (Optional) Set the DHCPv6
flood attack entry aging time.
4. Enter interface view.
5. Enable DHCPv6 flood attack
protection.
Command
system-view
interface interface-type
interface-number
ipv6 dhcp relay release-agent
Command
system-view
interface interface-type
interface-number
ipv6 dhcp client-detect
Command
system-view
ipv6 dhcp flood-protection
threshold packet-number
milliseconds
ipv6 dhcp flood-protection
aging-time time
interface interface-type
interface-number
ipv6 dhcp flood-protection
enable
200
Remarks
N/A
N/A
By default, IPv6 release
notification is disabled.
Remarks
N/A
N/A
By default, client offline
detection is disabled.
Remarks
N/A
By default, the device allows a
maximum of 6 DHCPv6 packets
per 5000 milliseconds from each
DHCPv6 client.
The default setting is 300
seconds.
N/A
By default, DHCPv6 flood attack
protection is disabled.