- About This Document
AAA Configuration
- Overview of AAA
Understanding AAA
- Application Scenarios for AAA
- Licensing Requirements and Limitations for AAA
- Summary of AAA Configuration Tasks
Configuring Local Authentication and Authorization
Configuring RADIUS AAA
Configuring HWTACACS AAA
- Clearing AAA Statistics
Configuration Examples for AAA
Troubleshooting AAA
802.1x Authentication Configuration
- Understanding 802.1x Authentication
- Application Scenarios for 802.1x Authentication
- Licensing Requirements and Limitations for 802.1x Authentication
- Default Settings for 802.1x Authentication
Configuring 802.1x Authentication
- Enabling 802.1x Authentication
- (Optional) Configuring the Authorization Mode of an Interface
- (Optional) Configuring the Access Control Mode of an Interface
- (Optional) Configuring the 802.1x Authentication Method
- (Optional) Configuring an 802.1x Authentication Domain
- (Optional) Enabling 802.1x Authentication Triggered by Unicast Packets
- (Optional) Configuring 802.1x Authentication Triggered by a DHCP Packet
- (Optional) Configuring the Maximum Number of Concurrent Access Users on an Interface
- (Optional) Configuring Timers for 802.1x Authentication
- (Optional) Configuring Re-authentication for Users
- (Optional) Configuring the Handshake Function for 802.1x Online Users
- Verifying the 802.1x Authentication Configuration
Maintaining 802.1x Authentication
Configuration Examples for 802.1x Authentication
ACL Configuration
- Overview of ACLs
Understanding ACLs
Application Scenarios for ACLs
- Licensing Requirements and Limitations for ACLs
- Default Settings for ACLs
Configuring a Basic ACL
Configuring an Advanced ACL
Configuring a Layer 2 ACL
Configuring a User-defined ACL
Configuring an ARP-based ACL
Configuring a Basic ACL6
Configuring an Advanced ACL6
Maintaining an ACL
Configuration Examples for ACLs
- Example for Configuring a Basic ACL to Limit Access to the FTP Server
- Example for Configuring a Basic ACL6 to Limit Access to the FTP Server
- Example for Using an Advanced ACL to Configure Traffic Classifiers
- Example for Using a Layer 2 ACL to Configure a Traffic Classifier
- Example for Using User-Defined ACLs to Filter the Specified Packets
ACL FAQ
TCAM ACL Customization Configuration
Microsegmentation Configuration
Local Attack Defense Configuration
- Overview of Local Attack Defense
- Licensing Requirements and Limitations for Local Attack Defense
- Default Settings for Local Attack Defense
Configuring CPU Attack Defense
- Creating an Attack Defense Policy
- Configuring a Blacklist
- Configuring the Filter
- Configuring a Rule for Sending Packets to the CPU
- Configuring Rules for the Switch to Limit the Rate of Packets in Enhanced Mode
- Configuring Port-based Automatic Local Attack Defense
- Configuring Host Attack Defense
- Applying an Attack Defense Policy
- Verifying the CPU Attack Defense Configuration
Configuring Attack Source Tracing
- Creating an Attack Defense Policy
- Configuring the Threshold for Attack Source Tracing
- Setting the Packet Sampling Ratio for Attack Source Tracing
- Configuring an Attack Source Tracing Mode
- Configuring the Types of Traced Packets
- Configuring a Whitelist for Attack Source Tracing
- Configuring Event Reporting Function
- Configuring Attack Source Punish Actions
- Applying an Attack Defense Policy
- Verifying the Attack Source Tracing Configuration
Maintaining Local Attack Defense
Configuration Examples for Local Attack Defense
Troubleshooting Local Attack Defense
MFF Configuration
- Overview of MFF
- Understanding MFF
- Application Scenarios for MFF
- Licensing Requirements and Limitations for MFF
Configuring MFF
- Enabling Global MFF
- Configuring a Network Interface
- Enabling MFF in a VLAN
- (Optional) Configuring a Static Gateway Address
- (Optional) Enabling Timed Gateway Address Detection
- (Optional) Configuring the Application Server IP Address
- (Optional) Configuring the Switch to Transparently Transmit ARP Request Packets
- (Optional) Configuring an Isolated Interface
- (Optional) Configuring MFF Security
- Verifying the MFF Configuration
Configuration Examples for MFF
Troubleshooting MFF
Attack Defense Configuration
- Overview of Attack Defense
Understanding Attack Defense
- Application Scenarios for Attack Defense
- Licensing Requirements and Limitations for Attack Defense
- Default Settings for Attack Defense
- Configuring Defense Against Malformed Packet Attacks
- Configuring Defense Against Packet Fragment Attacks
Configuring Defense Against Flood Attacks
- Clearing Attack Defense Statistics
Configuration Examples for Attack Defense
Traffic Suppression and Storm Control Configuration
- Overview of Traffic Suppression and Storm Control
Understanding Traffic Suppression and Storm Control
Application Scenarios for Traffic Suppression and Storm Control
- Licensing Requirements and Limitations for Traffic Suppression and Storm Control
- Default Settings for Traffic Suppression and Storm Control
Configuring Traffic Suppression
- Configuring Traffic Suppression on an Interface
- Configuring Traffic Suppression in a VLAN/BD
- Configuring Traffic Suppression for ICMP Packets
- Configuring Traffic Suppression on User-Side Interfaces in the BD View
- (Optional) Configuring the Device to Report Alarms When Packets Are Lost Due to Traffic Suppression
- (Optional) Configuring Traffic Suppression Associated with MAC Address Flapping
- Verifying the Traffic Suppression Configuration
- Configuring Storm Control
Configuration Examples for Traffic Suppression and Storm Control
ARP Security Configuration
- Overview of ARP Security
Understanding ARP Security
Application Scenarios for ARP Security
- Licensing Requirements and Limitations for ARP Security
- Default Settings for ARP Security
Configuring Defense Against ARP Flood Attacks
- Configuring Rate Limiting on ARP Packets based on Source MAC Addresses
- Configuring Rate Limiting on ARP Packets based on Source IP Addresses
- Configuring Rate Limit on ARP Packets based on the Destination IP Address
- Configuring Rate Limiting on ARP Packets Globally, in a VLAN, in a BD, or on an Interface
- Configuring ARP Rate Limiting on All Interfaces
- Configuring Rate Limiting on ARP Miss Messages based on Source IP Addresses
- Configuring Rate Limiting on ARP Miss Messages Globally, in a VLAN, or on an Interface
- Configuring the Aging Time of Temporary ARP Entries
- Configuring Gratuitous ARP Packet Discarding
- Configuring Strict ARP Learning
- Configuring Interface-based ARP Entry Limit
- Disabling an Interface from Learning ARP Entries
- Verifying the ARP Flood Attack Defense Configuration
Configuring Defense Against ARP Spoofing Attacks
- Configuring ARP Entry Fixing
- Configuring DAI
- Configuring ARP Gateway Anti-Collision
- Configuring Gratuitous ARP Packet Discarding
- Configuring Gratuitous ARP Packet Sending
- Configuring MAC Address Consistency Check in an ARP Packet
- Configuring Strict ARP Learning
- Verifying the ARP Spoofing Attack Defense Configuration
Maintaining ARP Security
Configuration Examples for ARP Security
Port Security Configuration
MACsec Configuration
DHCP Snooping Configuration
- Overview of DHCP Snooping
Understanding DHCP Snooping
Application Scenarios for DHCP Snooping
- Licensing Requirements and Limitations for DHCP Snooping
- Default Settings for DHCP Snooping
Configuring Basic Functions of DHCP Snooping
- Enabling DHCP Snooping
- Configuring an Interface as the Trusted Interface
- (Optional) Disabling Location Fixation for DHCP Snooping Users
- (Optional) Configuring an Association Between ARP and DHCP Snooping
- (Optional) Configuring the Device to Clear the MAC Address Entry Immediately When the User Is Disconnected
- Verifying the Basic DHCP Snooping Functions Configuration
Configuring DHCP Snooping Attack Defense
- Configuring Defense Against Bogus DHCP Server Attacks
- Configuring Defense Against Attacks from Non-DHCP Users
- Configuring Defense Against DHCP Flood Attacks
- Configuring Defense Against Bogus DHCP Message Attacks
- Configuring Defense Against DHCP Server DoS Attacks
- Configuring Rate Limiting on User Traffic Based on DHCP Snooping Binding Tables
- Verifying the DHCP Snooping Attack Defense Configuration
- Inserting the Option 82 Field in a DHCP Message
Maintaining DHCP Snooping
Configuration Examples for DHCP Snooping
Troubleshooting DHCP Snooping
IPSG Configuration
URPF Configuration
SSL Configuration
Keychain Configuration
FIPS Configuration
- Separating the Management Port from the Service Plane
- Checking Security Risks
- Setting the System Master Key