Configuration Guide - Security
S9300 and S9300X V200R019C10
This document describes the configurations of Security, including ACL, Reflective ACL, Local Attack Defense, MFF, Attack Defense, Traffic Suppression and Storm Control, ARP Security, Port Security, DHCP Snooping, ND Snooping, IPv6 RA Guard, PPPoE+, IPSG, SAVI, URPF, Keychian, MPAC, PKI, OLC, Separating the Management Plane from the Service Plane, and Security Risks.
Setting the Aging Time for Port Attack Defense
Context
After a device with port attack defense function enabled detects an attack on a port, the device traces the source and limits the rate of the attack packets on the port within the aging time (T seconds). When the aging time expires, the device calculates the protocol packet rate on the port again. If the rate is still above the protocol rate threshold, the device keeps tracing the source and limits the rate of the attack packets; otherwise, the device stops tracing the source.
If the aging time is too short, the device frequently starts packet rate detection on ports, which consumes CPU resources. If the aging time is too long, protocol packets cannot be promptly processed by the CPU, which affects services. Therefore, balance between the service operating status and CPU usage when setting an aging time.