No relevant resource is found in the selected language.

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy>Search

Reminder

To have a better experience, please upgrade your IE browser.

upgrade

Configuration Guide - Security

S1720, S2700, S5700, and S6720 V200R011C10

This document describes the configurations of Security, including ACL, local attack defense, MFF, attack defense, traffic suppression and storm control, ARP security, Port security, DHCP snooping, ND snooping, PPPoE+, IPSG, SAVI, URPF, keychain, MPAC, separating the management plane from the service plane, security risks, PKI.
Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
Example for Configuring the SAVI Function in a DHCPv6+SLAAC Scenario

Example for Configuring the SAVI Function in a DHCPv6+SLAAC Scenario

Networking Requirements

As shown in Figure 13-3, SwitchA functions as an access device to connect to hosts in an enterprise department. Some hosts in the department obtain IPv6 addresses using SLAAC, and other hosts obtain IPv6 addresses using DHCPv6. If an attacker sends a large number of invalid ND protocol packets, invalid DHCPv6 protocol packets, or invalid IPv6 data packets, communication of authorized users may be interrupted, and user accounts and passwords may be embezzled. To prevent these problems, the administrator wants to configure SwitchA to defend against invalid ND protocol packets, invalid DHCPv6 protocol packets, and invalid IPv6 data packets (with invalid source addresses) and provides users with stable services on a secure network.

Figure 13-3  Networking diagram for configuring the SAVI function in a DHCPv6+SLAAC scenario

Configuration Roadmap

The configuration roadmap is as follows:

  1. Configure DHCPv6 snooping so that bindings between address and ports can be generated for validity of the source addresses in DHCPv6 protocol packets and IPv6 data packets.

  2. Configure ND snooping so that bindings between address and ports can be generated for validity of the source addresses in ND protocol packets and IPv6 data packets.

  3. Enable the SAVI function so that the device can check the validity of the source addresses in DHCPv6 protocol packets and ND protocol packets based on the DHCPv6 snooping and ND snooping binding entries and filter out invalid packets.

  4. Enable IP source guard so that the device can check the validity of the source addresses in IPv6 data packets based on the DHCPv6 snooping and ND snooping binding entries and filter out invalid packets.

Procedure

  1. Enable the SAVI function.

    <HUAWEI> system-view
    [HUAWEI] sysname SwitchA
    [SwitchA] savi enable

  2. Create VLAN 2.

    [SwitchA] vlan batch 2
    

  3. Add GE0/0/1, GE0/0/2, and GE0/0/3 to VLAN 2.

    [SwitchA] interface gigabitethernet 0/0/1
    [SwitchA-GigabitEthernet0/0/1] port link-type access
    [SwitchA-GigabitEthernet0/0/1] port default vlan 2
    [SwitchA-GigabitEthernet0/0/1] quit
    [SwitchA] interface gigabitethernet 0/0/2
    [SwitchA-GigabitEthernet0/0/2] port link-type access
    [SwitchA-GigabitEthernet0/0/2] port default vlan 2
    [SwitchA-GigabitEthernet0/0/2] quit
    [SwitchA] interface gigabitethernet 0/0/3
    [SwitchA-GigabitEthernet0/0/3] port link-type trunk
    [SwitchA-GigabitEthernet0/0/3] port trunk allow-pass vlan 2
    [SwitchA-GigabitEthernet0/0/3] quit

  4. Configure DHCPv6 snooping.

    # Enable DHCPv6 snooping globally.

    [SwitchA] dhcp enable
    [SwitchA] dhcp snooping enable
    

    # Enable DHCPv6 snooping for VLAN 2.

    [SwitchA] vlan 2
    [SwitchA-vlan2] dhcp snooping enable
    

    # Enable DHCPv6 protocol packet validity check against the DHCPv6 snooping binding table in VLAN 2.

    [SwitchA-vlan2] dhcp snooping check dhcp-request enable
    [SwitchA-vlan2] quit
    

    # Configure GE0/0/3 connecting to the DHCP server as a trusted interface.

    [SwitchA] interface gigabitethernet 0/0/3
    [SwitchA-GigabitEthernet0/0/3] dhcp snooping trusted
    [SwitchA-GigabitEthernet0/0/3] quit
    

  5. Configure ND snooping.

    # Enable ND snooping globally.

    [SwitchA] nd snooping enable
    

    # Enable ND snooping for VLAN 2.

    [SwitchA] vlan 2
    [SwitchA-vlan2] nd snooping enable
    

    # Enable validity check for NA and NS packets in VLAN 2.

    [SwitchA-vlan2] nd snooping check na enable
    [SwitchA-vlan2] nd snooping check ns enable
    [SwitchA-vlan2] quit
    

    # Configure GE0/0/3 connecting to the ND server as a trusted interface.

    [SwitchA] interface gigabitethernet 0/0/3
    [SwitchA-GigabitEthernet0/0/3] nd snooping trusted
    [SwitchA-GigabitEthernet0/0/3] quit
    

  6. Enable IP source guard for VLAN 2.

    [SwitchA] vlan 2
    [SwitchA-vlan2] ip source check user-bind enable
    [SwitchA-vlan2] quit
    

  7. Verify the configuration.

    # Run the display this command in the system view to verify that the SAVI function, DHCPv6 snooping, and ND snooping are enabled globally.
    [SwitchA] display this
    ...
    #                                                                               
    dhcp enable                                                                     
    #                                                                               
    dhcp snooping enable                                                            
    #                                                                               
    nd snooping enable  
    savi enable
    #
    ...
    
    # Run the display this command in the VLAN view. The command output shows that DHCPv6 snooping, DHCPv6 protocol packet validity check against the DHCPv6 snooping binding table, ND snooping, ND protocol packet validity check, and IP source guard have been enabled in VLAN 2.
    [SwitchA] vlan 2
    [SwitchA-vlan2] display this
    #                                                                               
    vlan 2                                                                          
     dhcp snooping enable                                                           
     dhcp snooping check dhcp-request enable                                        
     nd snooping enable                                                             
     nd snooping check ns enable                                                    
     nd snooping check na enable                                                    
     ip source check user-bind enable 
    #                                                                               
    return                       
    
    [SwitchA-vlan2] quit
    
    # Run the display this command in the interface view to verify that GE0/0/3 is configured as the DHCP snooping trusted interface and the ND snooping trusted interface.
    [SwitchA] interface gigabitethernet 0/0/3
    [SwitchA-GigabitEthernet0/0/3] display this
    #                                                                               
    interface GigabitEthernet0/0/3                                                  
     port link-type trunk                                                           
     port trunk allow-pass vlan 2                                                   
     dhcp snooping trusted                                                            
     nd snooping trusted                                                            
    #                                                                               
    return             
    

Configuration Files

SwitchA configuration file

#
sysname SwitchA
#
vlan batch 2
#
dhcp enable                                                                     
#                                                                               
dhcp snooping enable                                                            
#                                                                               
nd snooping enable     
savi enable
#
vlan 2                                                                          
 dhcp snooping enable                                                           
 dhcp snooping check dhcp-request enable                                        
 nd snooping enable                                                             
 nd snooping check ns enable                                                    
 nd snooping check na enable                                                    
 ip source check user-bind enable 
#   
interface GigabitEthernet0/0/1
 port link-type access
 port default vlan 2
#   
interface GigabitEthernet0/0/2
 port link-type access
 port default vlan 2
#
interface GigabitEthernet0/0/3
 port link-type trunk                                                           
 port trunk allow-pass vlan 2                                                   
 dhcp snooping trusted                                                            
 nd snooping trusted                                                            
#   
return
Translation
Download
Updated: 2019-03-28

Document ID: EDOC1000178177

Views: 221907

Downloads: 720

Average rating:
This Document Applies to these Products
Related Documents
Related Version
Share
Previous Next