Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document.
Note: Even the most advanced machine translation cannot match the quality of professional translators.
Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
Example for Configuring ARP Security Functions
Networking Requirements
As shown in Figure 10-8, the switch connects to a server through 10GE1/0/3 and connects to four users in VLAN 10 and VLAN 20 through 10GE1/0/1 and 10GE1/0/2. The following ARP threats exist on the network:
- Attackers send bogus ARP packets or bogus gratuitous ARP packets to the switch. ARP entries on the switch are modified, leading to packet sending and receiving failures.
- Attackers send a large number of IP packets with unresolvable destination IP addresses to the switch, leading to CPU overload.
- User1 sends a large number of ARP packets with fixed MAC addresses but variable source IP addresses to the switch. As a result, ARP entries on the switch are exhausted and the CPU cannot process other services.
- User3 sends a large number of ARP packets with fixed source IP addresses to the switch. As a result, the CPU of the switch is insufficient to process other services.
Configuration Roadmap
The configuration roadmap is as follows:
- Configure strict ARP learning and ARP entry fixing to prevent ARP entries from being modified by bogus ARP packets.
- Configure gratuitous ARP packets discarding to prevent ARP entries from being modified by bogus gratuitous ARP packets.
- Configure rate limiting on ARP Miss messages based on source IP addresses. This function defends against attacks from ARP Miss messages triggered by a large number of IP packets with unresolvable IP addresses. At the same time, the switch must have the capability to process a large number of ARP Miss packets from the server to ensure network communication.
- Configure ARP entry limiting and rate limiting on ARP packets based on source MAC addresses. These functions defend against ARP flood attacks caused by a large number of ARP packets with fixed MAC addresses but variable IP addresses and prevent ARP entries from being exhausted and CPU overload.
- Configure rate limiting on ARP packets based on source IP addresses. This function defends against ARP flood attacks from User3 with a fixed IP address and prevents CPU overload.
Procedure
- Create VLANs, add interfaces to the VLANs, and configure VLANIF interfaces.
# Create VLAN 10, VLAN 20, and VLAN 30, add 10GE1/0/1 to VLAN 10, 10GE1/0/2 to VLAN 20, and 10GE1/0/3 to VLAN 30.
<HUAWEI> system-view [~HUAWEI] sysname Switch [*HUAWEI] commit [~Switch] vlan batch 10 20 30 [*Switch] interface 10ge 1/0/1 [*Switch-10GE1/0/1] port link-type trunk [*Switch-10GE1/0/1] port trunk allow-pass vlan 10 [*Switch-10GE1/0/1] quit [*Switch] interface 10ge 1/0/2 [*Switch-10GE1/0/2] port link-type trunk [*Switch-10GE1/0/2] port trunk allow-pass vlan 20 [*Switch-10GE1/0/2] quit [*Switch] interface 10ge 1/0/3 [*Switch-10GE1/0/3] port link-type trunk [*Switch-10GE1/0/3] port trunk allow-pass vlan 30 [*Switch-10GE1/0/3] quit
# Create VLANIF 10, VLANIF 20, and VLANIF 30, and assign IP addresses to them.
[*Switch] interface vlanif 10 [*Switch-Vlanif10] ip address 10.8.8.4 24 [*Switch-Vlanif10] quit [*Switch] interface vlanif 20 [*Switch-Vlanif20] ip address 10.9.9.4 24 [*Switch-Vlanif20] quit [*Switch] interface vlanif 30 [*Switch-Vlanif30] ip address 10.10.10.3 24 [*Switch-Vlanif30] quit
- Configure strict ARP learning.
[*Switch] arp learning strict
- Configure ARP entry fixing.
# Set the ARP entry fixing mode to fixed-mac.
[*Switch] arp anti-attack entry-check fixed-mac enable
- Configure gratuitous ARP packet discarding.
[*Switch] arp anti-attack gratuitous-arp drop
- Configure rate limiting on ARP Miss messages based on source IP addresses.
# Set the maximum rate of ARP Miss messages triggered by the server with the IP address 10.10.10.2 to 40 pps, and set the maximum rate of ARP Miss messages triggered by other user hosts to 20 pps.
[*Switch] arp miss anti-attack rate-limit source-ip maximum 20 [*Switch] arp miss anti-attack rate-limit source-ip 10.10.10.2 maximum 40
- Configure interface-based ARP entry limiting.
# Configure that 10GE1/0/1 can dynamically learn a maximum of 20 ARP entries.
[*Switch] interface 10ge 1/0/1 [*Switch-10GE1/0/1] arp limit vlan 10 20 [*Switch-10GE1/0/1] quit
- Configure rate limiting on ARP packets based on source MAC addresses.
# Set the maximum rate of ARP packets from User1 with the source MAC address 1-1-1 to 10 pps.
[*Switch] arp anti-attack rate-limit source-mac 1-1-1 maximum 10
- Configure rate limiting on ARP packets based on source IP addresses.
# Set the maximum rate of ARP packets from User3 with the source IP address 10.9.9.2 to 10 pps.
[*Switch] arp anti-attack rate-limit source-ip 10.9.9.2 maximum 10 [*Switch] commit [~Switch] quit
- Verify the configuration.
# Run the display arp learning strict command to check the global configuration of strict ARP entry learning.
<Switch> display arp learning strict The global arp learning strict state:enable Interface LearningStrictState ------------------------------------------------------------ ------------------------------------------------------------ Total:0 Force-enable:0 Force-disable:0# Run the display arp limit command to check the maximum number of ARP entries that the interface can dynamically learn.
<Switch> display arp limit interface 10ge 1/0/1 Interface VLAN Limit Learnt --------------------------------------------------------------------------- 10GE1/0/1 10 20 0 --------------------------------------------------------------------------- Total:1
# Run the display arp anti-attack rate-limit command to check the configuration of ARP anti-attack.
<Switch> display arp anti-attack rate-limit Global ARP packet rate limit (pps) : -- Suppress Rate of each destination IP (pps): 500 Total number of rate-limit configuration for source IP Address : 1 Source IP Suppress Rate(pps) ------------------------------------------------------------------------------- 10.9.9.2 10 ------------------------------------------------------------------------------- Total number of rate-limit configuration for MAC Address : 1 Source MAC Suppress Rate(pps) ------------------------------------------------------------------------------- 0001-0001-0001 10 Other 30 -------------------------------------------------------------------------------# Run the display arp anti-attack entry-check command to check the configuration of fixed ARP modes.
<Switch> display arp anti-attack entry-check Interface Mode ------------------------------------------------------------------------------- All fix-mac -------------------------------------------------------------------------------# Run the display arp miss anti-attack rate-limit command to check the configuration of ARP Miss anti-attack.
<Switch> display arp miss anti-attack rate-limit Global ARP miss rate limit (pps) : 3000 Total number of rate-limit configuration for source IP Address : 1 Source IP Suppress Rate(pps) ------------------------------------------------------------------------------- 10.10.10.2/32 40 Other 20 -------------------------------------------------------------------------------# Run the display arp packet statistics command to check statistics on ARP-based packets.
<Switch> display arp packet statistics ARP Packets Received Total: 90402 Learnt Count: 37 Discard For Entry Limit: 146 Discard For Speed Limit: 40529 Discard For Proxy Suppress: 0 Discard For Other: 8367601 ARP Packets Sent Total: 6447 Request: 6341 Reply: 106 Gratuitous ARP: 0 ARP-Miss Message Received Total: 12 Discard For Speed Limit: 194 Discard For Other: 238In the preceding command output, the numbers of ARP packets and ARP Miss messages discarded by the switch are displayed, indicating that the ARP security functions have taken effect.
Configuration File
# Configuration file of the Switch
# sysname Switch # vlan batch 10 20 30 # arp miss anti-attack rate-limit source-ip maximum 20 arp anti-attack rate-limit source-ip 10.9.9.2 maximum 10 arp miss anti-attack rate-limit source-ip 10.10.10.2 maximum 40 arp anti-attack rate-limit source-mac 0001-0001-0001 maximum 10 arp learning strict arp anti-attack entry-check fixed-mac enable arp anti-attack gratuitous-arp drop # interface Vlanif10 ip address 10.8.8.4 255.255.255.0 # interface Vlanif20 ip address 10.9.9.4 255.255.255.0 # interface Vlanif30 ip address 10.10.10.3 255.255.255.0 # interface 10GE1/0/1 port link-type trunk port trunk allow-pass vlan 10 arp limit vlan 10 20 # interface 10GE1/0/2 port link-type trunk port trunk allow-pass vlan 20 # interface 10GE1/0/3 port link-type trunk port trunk allow-pass vlan 30 # return