Cpu Protection Configuration; Function Of Cpu Protect; Principles Of Cpu Protect - D-Link xStack DGS-3610 Series Configuration Manual

DGS-3610 Series Configuration Guide
40
40.1 Overview
40.1.1

Function of CPU Protect

Malicious attacks often occur in the network environment, and such attacks will create too
much load for our switches. Sometimes when the packets in the network overload the
switches, this may cause too high CPU utilization on the switch and its abnormal operation.
Our L3 switches provide the CPP feature to reduce the CPU load and protect the normal
processing capability of the switch. When a switching card is attacked, the CLI management
interface for the card can still work normally, without too high CPU utilization. The
management packets from other switching cards can be processed in time by the switch.
Our switches allow you to configure the CPP on the switching card or management card to
adjust the corresponding thresholds for the most detailed management.
Caution
40.1.2

Principles of CPU Protect

The packets to be sent to the CPU of the management board are classified according to
their L2, L3 and L4 information into: ARP, BPDU, DHCP, IGMP, RIP, OSPF, PIM, GVRP,
VRRP, TTL-1 IPv4 packets, IPv6 multicast packets, unknown ipv4 broadcast packets.
The CPU ports have eight priority queues. You can configure the queue for each type of
packet and the hardware can automatically send the packets of the type to the specified
queue according to your configuration.
The CPU port sorts the packet queues through the strict priority algorithm. With this
algorithm, each queue has a different priority, where queue 7 has the highest priority, queue
6 a lower one, and queue 0 the lowest. The packets of the high priority queue are always
transmitted earlier than those in the lower priority queue. This way, you can map each type
of packets to a different priority queue according to its importance to ensure prior
transmission of the most important packets.

CPU Protection Configuration

The CPP (CPU Protect Policy) is a means used to enhance the switch
security. With the CPP, the processor and channel bandwidth resource of
the switch are protected to ensure the normal packet forwardingand
normal running of protocols.
Chapter 40 CPU Protection Configuration
40-1