This paper mainly introduces the ARP security in the S2750&S5700&S6700 series switch above the settings.
Prevent equipment performance and business impact due to improper ARP settings.
The software version of the switch used in the experiment is V200R003C00 .
This article is just to select the most important part of the ARP security, more, more detailed information, please refer to the equipment to help documentation.
arp-limit
Function
The arp-limit command sets the maximum number of ARP entries that an interface can dynamically learn.
The undo arp-limit command deletes the maximum number of ARP entries that an interface can dynamically learn.
By default, the maximum number of ARP entries that an interface can dynamically learn is the same as the number of ARP entries supported by the device.
Format
Ethernet interface view, 40GE interface view, GE interface view, GE sub-interface view, XGE interface view, XGE sub-interface view, Eth-Trunk interface view, Eth-Trunk sub-interface view, port group view
arp-limit vlan vlan-id1 [ to vlan-id2 ] maximum maximum
undo arp-limit vlan vlan-id1 [ to vlan-id2 ]
VLANIF interface view
arp-limit maximum maximum
undo arp-limit
Parameters
Parameter
|
Description
|
Value
|
vlan vlan-id1 [ to vlan-id2 ]
|
Specifies the ID of a VLAN from which the maximum number of ARP entries an interface can dynamically learn is limited. This parameter is available only for Layer 2 interfaces.
Where,
- vlan-id1 specifies the first VLAN ID.
- to vlan-id2 specifies the last VLAN ID. vlan-id2 must be larger than vlan-id1. vlan-id1 and vlan-id2 specify a range of VLANs. If to vlan-id2 is not specified, the device limits the maximum number of ARP entries an interface dynamically learns from the VLAN vlan-id1. If to vlan-id2 is specified, the device limits the maximum number of ARP entries an interface dynamically learns from each VLAN from vlan-id1 to vlan-id2.
|
The values of vlan-id1 and vlan-id2 are integers that range from 1 to 4094.
|
maximum maximum
|
Specifies the maximum number of ARP entries that an interface can dynamically learn.
|
The value is an integer that ranges The value ranges from 1 to 2048 for the S5700SI, from 1 to 8192 for the S5700EI, from 1 to 16384 for the S5700HI and S5710HI, from 1 to 16384 for the S5710EI, from 1 to 256 for the S2750, S5700LI, and S5700S-LI, and from 1 to 8192 for the S6700.
|
Views
Ethernet interface view, 40GE interface view, GE interface view, GE sub-interface view, XGE interface view, XGE sub-interface view, Eth-Trunk interface view, Eth-Trunk sub-interface view, port group view, VLANIF interface view
Default Level
2: Configuration level
Usage Guidelines
Usage Scenario
To prevent ARP entries from being exhausted by ARP attacks from a host connecting to an interface on the device, set the maximum number of ARP entries that the interface can dynamically learn. When the number of the ARP entries learned by a specified interface reaches the maximum number, no dynamic ARP entry can be added.
Precautions
If the number of ARP entries learned by an interface exceeds the maximum number, the device neither learns new ARP entries nor clears the learned ARP entries. Instead, the device asks users to delete the excess ARP entries.
Example
# Configure that VLANIF 10 can dynamically learn a maximum of 20 ARP entries.
<HUAWEI> system-view
[HUAWEI] interface vlanif 10
[HUAWEI-Vlanif10] arp-limit maximum 20
# Configure that GE0/0/1 can dynamically learn a maximum of 20 ARP entries corresponding to VLAN 10.
<HUAWEI> system-view
[HUAWEI] interface gigabitethernet 0/0/1
[HUAWEI-GigabitEthernet0/0/1] arp-limit vlan 10 maximum 20
arp anti-attack rate-limit enable
Function
The arp anti-attack rate-limit enable command enables rate limit on ARP packets.
The undo arp anti-attack rate-limit enable command disables rate limit on ARP packets.
By default, rate limit on ARP packet is disabled.
Product
|
Support
|
S2750
|
Not Supported
|
|
|
Supported (excluding S5700LI and S5700S-LI)
|
|
|
Supported
|
Format
arp anti-attack rate-limit enable
undo arp anti-attack rate-limit enable
Parameters
None
Views
System view, VLAN view, 40GE interface view, GE interface view, XGE interface view, port group view, Eth-Trunk interface view
Default Level
2: Configuration level
Usage Guidelines
The device has no sufficient CPU resource to process other services when processing a large number of ARP packets. To protect CPU resources of the device, limit the rate of ARP packets.
You can run the arp anti-attack rate-limit enable command to enable rate limit on ARP packets. When the rate of ARP packets exceeds the limit, excess ARP packets are discarded. To set the rate limit and rate limit duration of ARP packets, run the arp anti-attack rate-limit command.
Example
# Enable rate limit on ARP packets globally.
<HUAWEI> system-view
[HUAWEI] arp anti-attack rate-limit enable
arp anti-attack rate-limit
Function
The arp anti-attack rate-limit command sets the maximum rate and rate limit duration of ARP packets globally, in a VLAN, or on an interface, enables the function of discarding all ARP packets received from the interface when the rate of ARP packets exceeds the limit on an interface.
The undo arp anti-attack rate-limit command restores the default maximum rate and rate limit duration of ARP packets globally, in a VLAN, or on an interface, and allows the device to send ARP packets to the CPU again.
By default, a maximum of 100 ARP packets are allowed to pass in 1 second, and the function of discarding all ARP packets received from the interface when the rate of ARP packets exceeds the limit is disabled.
Product
|
Support
|
S2750
|
Not Supported
|
S5700
|
Supported (excluding S5700LI and S5700S-LI)
|
S6700
|
Supported
|
Format
System view, VLAN view
arp anti-attack rate-limit packet packet-number [ interval interval-value ]
undo arp anti-attack rate-limit
Interface view
arp anti-attack rate-limit packet packet-number [ interval interval-value | block-timer timer ]*
undo arp anti-attack rate-limit
Parameters
|
|
Description
|
Value
|
packet packet-number
|
Specifies the maximum rate of sending ARP packets, that is, the number of ARP packets allowed to pass through in the rate limit duration.
|
The value is an integer that ranges from 1 to 16384. The default value is 100.
|
interval interval-value
|
Specifies the rate limit duration of ARP packets.
|
The value is an integer that ranges from 1 to 86400, in seconds. The default value is 1 second.
|
block-timer timer
|
Specifies the duration for blocking ARP packets.
|
The value is an integer that ranges from 5 to 864000, in seconds.
|
Views
System view, VLAN view, 40GE interface view, GE interface view, XGE interface view, port group view, Eth-Trunk interface view
Default Level
2: Configuration level
Usage Guidelines
Usage Scenario
After rate limit on ARP packets is enabled, run the arp anti-attack rate-limit command to set the maximum rate and rate limit duration of ARP packets globally, in a VLAN, or on an interface. In the rate limit duration, if the number of received ARP packets exceeds the limit, the device discards the excess ARP packets.
If the parameter block-timer timer is specified, the device discards all ARP packets received in the duration specified by timer.
Prerequisites
Rate limit on ARP packets has been enabled globally, in a VLAN, or on an interface using the arp anti-attack rate-limit enable command.
Precautions
If the maximum rate and rate limit duration are configured in the system view, VLAN view, and interface view, the device uses the configurations in the interface view, VLAN view, and system view in order.
If the maximum rate and rate limit duration are set globally or on an interface at the same time, the configurations on an interface and globally take effect in descending order of priority.
NOTE:
The arp anti-attack rate-limit command takes effect only on ARP packets sent to the CPU for processing in none-block mode, and does not affect ARP packet forwarding by the chip. In block mode, only when the number of ARP packets sent to the CPU exceeds the limit, the device discards subsequent ARP packets on the interface.
Example
# Configure GE0/0/1 to allow 200 ARP packet to pass through in 10 seconds, and configure GE0/0/1 to discard all ARP packets in 60 seconds when the number of ARP packets exceeds the limit.
<HUAWEI> system-view
[HUAWEI] interface gigabitethernet 0/0/1
[HUAWEI-GigabitEthernet0/0/1] arp anti-attack rate-limit enable
[HUAWEI-GigabitEthernet0/0/1] arp anti-attack rate-limit packet 200 interval 10 block-timer 60
More blog:
