No relevant resource is found in the selected language.

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy>Search


To have a better experience, please upgrade your IE browser.


Configuration Guide - Security

S1720, S2700, S5700, and S6720 V200R011C10

This document describes the configurations of Security, including ACL, local attack defense, MFF, attack defense, traffic suppression and storm control, ARP security, Port security, DHCP snooping, ND snooping, PPPoE+, IPSG, SAVI, URPF, keychain, MPAC, separating the management plane from the service plane, security risks, PKI.
Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
RA Attack Defense

RA Attack Defense

An RA packet can carry much network configuration information, including the default router, the prefix list, and whether to use the DHCPv6 server for stateful address allocation. As shown in Figure 10-2, an attacker sends a forged RA packet to change the network configuration on a host. Then the host cannot communicate with other hosts. Common RA attacks include:

  • Forged RA packets with non-existing prefixes cause authorized hosts to modify their routing tables.
  • Forged RA packets with the gateway MAC address cause authorized hosts to record incorrect ND entries for the gateway. If an attacker forges the Router Lifetime field in RA packets, authorized hosts change the default gateway (default router) to another gateway.
  • If an attacker sends RA packets with a forged DHCPv6 server address and M bit, the authorized hosts use the forged IP addresses allocated by the bogus DHCPv6 server.

The Router Lifetime field in an RA packet indicates the lifetime of the sender router that functions as the default router. If the value is 0, the router cannot function as the default router but other information in the RA packet is still valid.

The M bit is the managed address configuration bit, and the value can be 0 or 1. The value 0 indicates stateless address allocation. A host uses stateless protocols such as ND to obtain an IPv6 address. The value 1 indicates stateful address allocation. A host uses stateful protocols such as DHCPv6 to obtain an IPv6 address.

Figure 10-2  Defense against RA attacks

To defend against RA attacks, enable ND snooping on interface 1 and interface 3 of the Switch, and configure interface 3 connecting to the gateway as a trusted interface. Then, the Switch discards RA packets received from interface 1 and processes only packets received from the trusted interface, which prevents RA attacks.

Updated: 2019-03-28

Document ID: EDOC1000178177

Views: 221520

Downloads: 718

Average rating:
This Document Applies to these Products
Related Documents
Related Version
Previous Next