S12700 V200R013C00 Command Reference

Usage Scenario

Attack source tracing samples packets to identify attacks. Errors may occur in attack packet identification or packet rate calculation. A proper packet sampling ratio can reduce errors. A small sampling ratio makes the attack source tracing result accurate, but increases CPU usage. For example, when the sampling ratio is set to 1, every packet is sampled. The attack source tracing result is accurate, but the CPU usage is high because every packet is resolved.

The auto-defend attack-packet sample command sets the sampling ratio. You can set a proper value based on the requirements of attack source tracing precision and CPU usage.

Prerequisites

Attack source tracing has been enabled using the auto-defend enable command.

Precautions

When a smaller attack source tracing threshold is used, the sampling ratio has greater impact on the attack source tracing result.

Usage Scenario

A large number of attack packets may attack the device CPU. Attack source tracing enables the device to trace attack sources and send logs or alarms to notify the administrator so that the administrator can take measures to defend against the attacks. By default, logs are sent to notify the administrator if attack source tracing is enabled.

After automatic attack source tracing is enabled, the device traces the source of the specified packets sent to the CPU. The packet type can be set using the auto-defend protocol command.

Precautions

Attack source tracing configured in an attack defense policy takes effect only when the attack defense policy is applied in the system view or slot view.

If the system software of a switch in a version earlier than V200R009C00 is upgraded to V200R009C00 or later version, an undo auto-defend enable configuration is automatically generated.

Usage Scenario

The attack source tracing process consists of four phases: packet parsing, traffic analysis, attack source identification, and taking attack source punish actions. The auto-defend action command is applied to taking attack source punish actions. The device discards the packets sent from the identified source or shuts down the interface receiving attack packets.

NOTE:

If the auto-defend action is set to shutdown, run the error-down auto-recovery cause auto-defend interval interval-value command to set a recovery delay before the device is attacked. This command is invalid for the interface in error-down state.

Prerequisites

Attack source tracing has been enabled using the auto-defend enable command.

Precautions

If you run the auto-defend action command multiple times, only the latest configuration takes effect.

After the auto-defend action is set to deny, the device discards packets when being attacked. The configuration result can be verified using the display auto-defend attack-source command.

The device does not take punish actions on attack sources of whitelist users.

If the device shuts down the interface that receives the attack packets, services of authorized users on the interface are interrupted. Exercise caution when you configure the device to shut down the interface.

Usage Scenario

When the number of packets of a specified protocol from an attack source exceeds the threshold in a specified period, the device reports an event to the administrator so that the administrator can take measures to protect the device.

Prerequisites

Attack source tracing has been enabled using the auto-defend enable command.

Follow-up Procedure

Run the auto-defend threshold command to set the event reporting threshold for attack source tracing.

Usage Scenario

The attack source tracing process consists of four phases: packet parsing, traffic analysis, attack source identification, and taking attack source punish actions. The auto-defend protocol command is applied to the packet parsing phase. When an attack occurs, you cannot identify the type of attack packets. The auto-defend protocol command allows you to flexibly specify the types of traced packets.

Prerequisites

Attack source tracing has been enabled using the auto-defend enable command.

Precautions

• If you run this command multiple times, only the latest configuration takes effect.
• If a packet type is specified, when the device is attacked and the attack source is traced, you can run the display auto-defend attack-source command to view attack source information.
• When attack source tracing is applied to ICMPv6 packets, the function takes effect on only the ICMPv6 packets of which the destination IPv6 addresses are local interface addresses.

Usage Scenario

After attack source tracing is enabled, you can set the checking threshold and event reporting threshold for attack source tracing. When the number of sent protocol packets from an attack source in a specified period exceeds the checking threshold, the device traces and logs the attack source.

Prerequisites

Attack source tracing has been enabled using the auto-defend enable command.

Precautions

If you run the auto-defend threshold command in the same attack defense policy view multiple times, only the latest configuration takes effect.

After the auto-defend enable command is executed, the device traces the attack source based on the default threshold even if the auto-defend threshold command is not used.

Usage Scenario

After enabling attack source tracing, you can specify one or more attack source tracing modes. The device then uses the specified modes to trace attack sources.

The device supports the following attack source tracing modes:

• Source IP address-based tracing: defends against Layer 3 attack packets.
• Source MAC address-based tracing: defends against Layer 2 attack packets with a fixed source MAC address.
• Source port+VLAN based tracing: defends against Layer 2 attack packets with different source MAC addresses.

Prerequisites

Attack source tracing has been enabled using the auto-defend enable command.

Precautions

In VXLAN scenarios, the source port+VLAN based tracing mode is not supported. In addition, if the tunnel-side interface resides on the ET1D2X48SEC0 card, the source IP address-based tracing mode is not supported.

Table 14-23 lists the attack source tracing modes supported for different types of packets.

If you run this command multiple times, only the latest configuration takes effect.

A switch supports different numbers if attack source tracing modes for different protocol packets. For details, see the default modes described above.

After the attack source tracing function is enabled on the device, you can run the display auto-defend attack-source command to view attack source tracing information if an attack occurs.

When the attack source tracing mode is source-ip and action is error-down, if multiple interfaces receive the attack packets with the same source IP address and the packet rate exceeds the threshold, the switch shuts down only one interface, and then checks packet rate again. If the packet rate is still higher than the threshold, the switch shuts down another interface. The switch repeats the operations until the packet rate falls below the threshold.

Usage Scenario

Attack source tracing helps locate and punish sources of denial of service (DoS) attacks. If some users do not need to be traced regardless of whether an attack occurs, run the auto-defend whitelist command to configure a whitelist for users.

Prerequisites

Attack source tracing has been enabled using the auto-defend enable command.

Precautions

Before referencing an ACL in a whitelist, create the ACL and configure rules.

If the ACL referenced by the whitelist specifies some protocols, ensure that packets of these protocols can be traced. You can run the display auto-defend configuration command to view the protocols supported by attack source tracing. If a protocol is not supported by attack source tracing, you can run the auto-defend protocol command to configure attack source tracing to support the protocol.

Usage Scenario

After a device with port attack defense function enabled detects an attack on a port, the device traces the source and limits the rate of the attack packets on the port within the aging time (T seconds). When the aging time expires, the device calculates the protocol packet rate on the port again. If the rate is still above the protocol rate threshold, the device keeps tracing the source and limits the rate of the attack packets; otherwise, the device stops the operations.

If the aging time is too short, the device frequently starts packet rate detection on ports, which consumes CPU resources. If the aging time is too long, protocol packets cannot be promptly processed by the CPU, which affects services. Therefore, you need to run the auto-port-defend aging-time command to set an appropriate aging time according to the CPU usage and service status.

Prerequisites

The port attack defense function has been enabled using the auto-port-defend enable command.

Precautions

If you run the auto-port-defend aging-time command multiple times in the same attack defense policy view, only the latest configuration takes effect.

Usage Scenario

If a port undergoes a DoS attack, the malicious attack packets sent from this port to the CPU occupy bandwidth. As a result, the CPU cannot process the protocol packets sent from other ports, and services are interrupted. In this situation, you can enable the report of port attack defense events. When the rate of protocol packets on a port exceeds the check threshold, the switch reports an event to notify the network administrator, so that the administrator can promptly take measures to protect the switch.

Prerequisites

The port attack defense function has been enabled using the auto-port-defend enable command.

Follow-up Procedure

Run the auto-port-defend protocol { all | arp-request | arp-reply | dhcp | icmp | igmp | ip-fragment } threshold threshold command to set the threshold for protocol packet check in port attack defense.

Usage Scenario

If an attacker initiates a DoS attack on a port, the malicious attack packets sent from this port to the CPU occupy bandwidth. As a result, the CPU cannot process the protocol packets sent from other ports, and services are interrupted.

The port attack defense function effectively limits the number of packets sent to the CPU, and prevents DoS attacks aiming at the CPU.

This function is enabled by default. If the number of packets received by a port within one second exceeds the protocol rate threshold, the device considers that an attack occurs on the port. Then the device traces the source and limits the rate of attack packets, and records an attack log to avoid impact on other ports.

Precautions

After the port attack defense function is enabled in an attack defense policy, the attack defense policy must be applied in the system view or slot view.

Usage Scenario

By default, the device calculates the rate of all protocol packets, including ARP Request, ARP Reply, DHCP, ICMP, IGMP, and IP fragment packets, received by a port, and traces the source and limits the rate of attack packets. If the packets exceeding protocol rate threshold contain only a few attack packets, you can run the undo auto-port-defend protocol command to cancel port attack defense for unneeded protocol types. If the device limits the rate of too many protocols, services are affected.

Prerequisites

The port attack defense function has been enabled using the auto-port-defend enable command.

Precautions

If you run this command multiple times in the same attack defense policy view, only the latest configuration takes effect.

After port attack defense is applied to a type of protocol packets, the display auto-port-defend attack-source command can display the attack source tracing information if the port is attacked by the specified protocol packets.

Usage Scenario

After port attack defense is enabled on a port, the device calculates the rate of affected protocol packets received by the port. If the packet rate exceeds the protocol rate threshold, the device considers that an attack occurs. Then the device traces the source and limits the rate of attack packets on the port, and records a log. The device moves the packets within the protocol rate limit (CPCAR in attack defense policies) to the low-priority queue, and then sends them to the CPU. The device discards the excess packets.

You need to set an appropriate rate threshold for port attack defense according to service requirements. If the CPU fails to process many protocol packets promptly after port attack defense is enabled, set a large packet rate threshold. If the CPU is busy processing the packets of a protocol, set a small rate threshold for this protocol to avoid impact on other services.

Prerequisites

The port attack defense function has been enabled using the auto-port-defend enable command.

Precautions

If you run the auto-port-defend protocol threshold command multiple times in the same attack defense policy view, only the latest configuration takes effect.

Usage Scenario

A device with port attack defense enabled identifies attacks by analyzing sampled packets. There may be errors in attack packet identification or packet rate calculation. Errors influence the attack defense effect. An appropriate sampling ratio helps you control attack defense accuracy.

A small sampling ratio improves attack defense accuracy, but consumes more CPU resources. When the sampling ratio is set to 1, the device analyzes every packet. The attack packets can be detected quickly, but CPU usage becomes high and services are affected. Therefore, make a balance between the attack defense requirement and CPU usage to decide a sampling ratio.

Prerequisites

The port attack defense function has been enabled using the auto-port-defend enable command.

Precautions

If the protocol packet rate threshold for port attack defense is set to a small value, the attack identification error caused by packet sampling ratio is large.

Usage Scenario

The port attack defense function is enabled by default on the device, so the device calculates protocol packet rates on all interfaces, and traces the source and limits the rate of attack packets. In some services, network-side interfaces need to receive a lot of valid protocol packets. You should add these interfaces or network nodes connecting to these interfaces to the whitelist. The device does not trace the source or limit the rate of protocol packets received by the interfaces in the whitelist.

Prerequisites

The port attack defense function has been enabled using the auto-port-defend enable command.

Precautions

To define the whitelist using an ACL, you must create an ACL and configure rules for the ACL.

Before configuring an ACL whitelist for some protocols, ensure that the port attack defense function supports these protocols. Use the auto-port-defend protocol command to specify the protocols to which port attack defense is applied.

To defend against malicious packet attacks, the device uses ACLs to add users with the specific characteristic into a blacklist and discards the packets from the users in the blacklist.

An attack defense policy can contain a maximum of eight blacklists (including IPv4 and IPv6 blacklists).

For X series cards, the discarded packet statistics collected by the display cpu-defend statistics command do not contain the statistics on the packets sent from blacklisted users. For other cards, packets sent from blacklisted users are discarded after traffic statistics are collected; therefore, you can run the display cpu-defend statistics command to view statistics on the packets sent from blacklisted users.

Usage Scenario

The switch has default CAR values for each type of protocol packet. You can adjust CAR values for specified types of protocol packets based on services and network environment.

Improper CPCAR settings will affect services on your network. If you need to adjust CPCAR settings, you are advised to contact technical support personnel for help.

For MPUs and X series cards, the device limits the rate of some protocol packets in pps mode. That is, the actual CPCAR value is the number of packets allowed to pass per second, which is calculated as follows:

CIR value x 1024/(8 x Packet length)

For example, if the CIR value of 802.1X packets is set to 64 kbit/s, 40 802.1X packets are allowed to pass per second. The number 40 is calculated as follows:

64 x 1024/(8 x 200) = 40.96 (rounded down to the integer 40)

The following table lists the types and lengths of packets that support rate limiting in pps mode.

Precautions

If you run the deny command and then the car command, the car command takes effect; if you run the car command, and then the deny command, the deny command takes effect.

NOTE:

When the actual and configured rates of packets sent to the CPU are large, the CPU usage may be high and the performance may deteriorate. In the worst situation, the CSS breaks.

Usage Scenario

The default CAR value of BGP, FTP, HTTP, HTTPS, OSPF, SSH, TFTP, or TELNET protocol is small. When a switch uses these protocols to transfer files or set up connections with other hosts or devices, the number of protocol packets sharply increases in a short period. When the packet rate exceeds the limit, the protocol packets are dropped. The switch may also undergo attacks of other protocols. This affects data transmission and causes service interruption.

You can run the cpu-defend application-apperceive command to enable ALP, ensuring normal operation of BGP, FTP, HTTP, HTTPS, OSPF, SSH, TFTP, or TELNET services when attacks occur. When a connection is set up, the switch sends packets at the rate of the CPCAR value configured using the linkup-car command. The CPCAR value can be set as required.

Precautions

To enable the ALP function for a certain protocol, run the cpu-defend application-apperceive enable command to enable ALP globally. For example, before enabling ALP for the TFTP protocol, run the cpu-defend application-apperceive enable command, and then the cpu-defend application-apperceive tftp enable command to make the configuration take effect.

Before running the linkup-car command, you are advised to run the display cpu-defend configuration command to check the CIR value supported by the current protocol or displayed CIR value.

Usage Scenario

A fixed default CIR value may not adapt to dynamic requirements on rate limiting for protocol packets. The cpu-defend dynamic-car enable command enables a switch to dynamically adjust the default CIR value for protocol packets.

If the default CIR value for a protocol has never been changed, the switch dynamically adjusts the default CIR value for the protocol packets based on service scale (for example, number of dynamic ARP entries) and CPU usage to meet various service requirements. For details, see Table 14-24, Table 14-25, and Table 14-26.

NOTE:

When the number of entries increases, the CPCAR value is dynamically increased. When the CPU usage is between 70% to 98%, the dynamic CPCAR adjustment stops. If the CPU usage is greater than 98%, the default CPCAR value is used.

If ospf and arp are not specified, the switch is globally enabled to dynamically adjust the default CIR value of a protocol packet.

Precautions

The switch dynamically adjusts the default CIR value for OSPF or ARP protocol packets only when the function is enabled globally and on OSPF or ARP protocol packets.

The default CIR value dynamically adjusted only takes effect when the CIR value of the protocol packet is not manually changed.

After the default CPCAR setting is modified for OSPF, only the CIR value for OSPF and OSPF hello packets is adjusted.

After the default CPCAR setting is modified for ARP, only the CIR value for ARP reply, Unicast ARP request, and ARP request packets is adjusted.

Usage Scenario

By default, the switch limits the rates of the ARP, ND, DHCP Request, DHCPv6 Request, and 8021x packets received from user MAC addresses, including wired and wireless users, and discards excessive packets when the packet rates exceed the rate limit. If you need to limit the rate of only IGMP and HTTPS-SYN packets or packets of the specified types, specify the packet type.

Precautions

• Before using this command, run the cpu-defend host-car enable command to enable user-level rate limiting.
• If the command is run multiple times, the user-level rate limiting applies to the packet type specified in the last command. For example, if the command specifying ARP and DHCP Request packets is run, and then the cpu-defend host-car arp command is run, the user-level rate limiting applies to only ARP packets.
• After the cpu-defend host-car all command is run, the configuration file displays cpu-defend host-car 8021x arp dhcp-request dhcpv6-request https-syn igmp nd.

Usage Scenario

User-side hosts are prone to virus attacks. Infected hosts may send a large number of protocol packets to network devices, causing a high CPU usage and degraded performance on the devices and affecting services. You can configure the user-level rate limiting to resolve this problem. User-level rate limiting identifies users by user MAC addresses and limits the rates of specified packets (ARP, ND, DHCP Request, DHCPv6 Request, IGMP, 802.1X, and HTTPS-SYN packets) for both wired and wireless users. By default, the threshold for each user MAC address is 10 pps.

The user-level rate limiting is more precise than CPCAR (based on card) and port attack defense (based on interface) because it is user-specific and has little impact on online users.

Precautions

• It is recommended that you disable user-level rate limiting on the network-side interfaces of an access switch and a gateway switch. The user-level rate limiting is enabled on interfaces by default.

• In the user-level rate limiting, the system performs a hash calculation for the source MAC addresses of specified packets, and places the packets into different buckets. Therefore, multiple users may share the rate limit. When traffic volume is heavy, packets may be dropped. If you confirm that these users are authorized, run the cpu-defend host-car mac-address mac-address command to increase the rate threshold for the specified MAC addresses.

Usage Scenario

User-level rate limiting identifies users by user MAC addresses and limits the rates of specified packets (ARP, ND, DHCP Request, DHCPv6 Request, IGMP, 802.1X, and HTTPS-SYN packets) for both wired and wireless users. By default, the user-level rate limit is 10 pps. You can set a rate limit based on user.

Precautions

• Before using this command, run the cpu-defend host-car enable command to enable user-level rate limiting.
• If the rate limit is too high, attacks cannot be prevented and CPU may be overloaded.
• If both the cpu-defend host-car mac-address mac-address pps pps-value and cpu-defend host-car pps pps-value commands are run, the rate limit for the specified MAC address is determined by the former command, and the rate limit for other MAC addresses is determined by the latter command.
• The user-level rate limiting performs a hash calculation for the source MAC addresses of specified packets, and places the packets into different buckets. When two user MAC addresses are mapped to the same bucket index, the two users share the same rate limit (in pps mode). If the two users modify the rate limit for the bucket simultaneously, the setting will be overwritten. To avoid this situation, the rate limit for the specified MAC address cannot be set upon hash conflict.
• When the cpu-defend host-car mac-address mac-address pps pps-value and cpu-defend host-car pps pps-value commands are run to configure the rate limit for multiple MAC addresses, the settings are displayed in the alphabetic order in the configuration file.

Usage Scenario

A large number of packets including malicious attack packets are sent to the CPU on a network. If excess packets are sent to the CPU, the CPU usage becomes high and CPU performance deteriorates. The attack packets affect services and may even cause system breakdown. To solve the problem, create an attack defense policy and configure CPU attack defense and attack source tracing in the attack defense policy.

Precautions

The device supports a maximum of 33 attack defense policies, including the default attack defense policy. The default attack defense policy is generated in the system by default and is applied to all boards. The default attack defense policy cannot be deleted or modified. The other 32 policies can be created, modified, and deleted.

The configuration in a user-defined attack defense policy overrides the configuration in the default attack defense policy. If no parameter is set in the user-defined attack defense policy, the configuration in the default attack defense policy is used.

When the default attack defense policy is used, protocol packets sent to the CPU and user-defined flows are limited based on the default CIR value.

Usage Scenario

The packets destined for the CPU can be directly sent to the main control board, or sent to the main control board through LPUs. Therefore, attack defense policies must be configured on both the main control board and LPUs.

Before applying attack defense policies, check attack information on the main control board and LPUs, for example, source IP addresses of attack packets and attack packet types. If the attack information on the main control board and LPUs is consistent, apply the same attack defense policy to the main control board and LPUs; otherwise, apply different policies to them.

Prerequisites

An attack defense policy has been created by using the cpu-defend policy command.

Precautions

• When the cpu-defend-policy command is executed in the system view, if global is not specified, the attack defense policy is applied to the MPU; if global is specified, the attack defense policy is applied to all LPUs.
• When the cpu-defend-policy command is executed in the slot view, you cannot specify global. The attack defense policy is applied to the LPU in the slot.

If the parameters such as the threshold and sampling ratio are specified in attack defense policies, the parameter values set for the main control board must be larger than those set for LPUs.

If an attack defense policy is applied to an LPU, the blacklist, whitelist, and user-defined flow take effect for only the packets destined for CPUs of LPUs. If an attack defense policy is applied to the main control board, the blacklist, whitelist, and user-defined flow take effect for only the packets destined for CPUs of the main control boards.

Only one attack defense policy can be applied to a card.

Usage Scenario

To protect the CPU, a switch limits the rate of protocol packets sent to the CPU based on the CPCAR. If the rate of protocol packets exceeds the CPCAR, excess protocol packets are dropped. As a result, the corresponding service may not run normally. To quickly detect packet loss caused by CPCAR exceeding, you can use this command to enable alarm reporting for this event. After this function is enabled, the switch checks for packet loss caused by CPCAR at 10-minute intervals. If the switch finds that the number of dropped packets of a protocol increases, the switch reports a packet loss alarm.

Precautions

After this alarm reporting function is enabled, the switch reports packet loss alarms based on protocol types. That is, if the rates of packets of multiple protocols exceed the CPCAR values set for these protocols, the switch reports an alarm for each protocol.

Usage Scenario

After an attack defense policy is created, if the device receives attack packets of a specified type or a large number of packets sent to the CPU, run the deny command to configure the device to discard packets of the specified type sent to the CPU.

Precautions

If you run the deny command, and then the car command, the car command takes effect; if you run the car command, and then the deny command, the deny command takes effect. After the undo deny command is executed, the default action for packets sent to the CPU is restored, that is, CIR and CBS actions are performed.

Usage Scenario

The description command configures the description of an attack defense policy, for example, the usage or application scenario of the attack defense policy. The description is used to differentiate attack defense policies.

Precautions

If you run the description command in the same attack defense policy view multiple times, only the latest configuration takes effect.

The display auto-defend attack-source command displays the attack sources.

If slot slot-id is not specified, information about attack sources on the MPU is displayed.

After attack source tracing is configured in an attack defense policy, you can run the display auto-defend configuration command to view the attack source tracing configuration.

After the whitelist for attack source tracing is configured or when you locate faults on network, run the display auto-defend whitelist command to verify whitelist information. If no whitelist is configured, the command displays no whitelist information.

The source tracing information helps you locate attack sources.

To view the configuration of port attack defense, use this command.