Contents

Configuring protocol packet rate limit 1

About protocol packet rate limit 1

Restrictions and guidelines: Protocol packet rate limit 1

Procedure· 1

Verifying and maintaining protocol packet rate limit 2

Protocol packet rate limit configuration examples· 2

Example: Configuring protocol-based protocol packet rate limit 2

Example: Configuring flow-based protocol packet rate limit 3

 

Configuring protocol packet rate limit

About protocol packet rate limit

The protocol packet rate limit feature rate limits packets sent to the CPU, effectively preventing flood and DoS attacks.

The device supports the following protocol packet rate limit methods:

·     Protocol-based protocol packet rate limit—Limits the maximum transmission rate of protocol packets of a specific protocol. Excessive protocol packets are dropped.

·     Flow-based protocol packet rate limit—Identifies flows of a protocol by source IP or MAC address, and limits the maximum transmission rate per flow. Excessive protocol packets are dropped. This method collects traffic statistics by flow and protocol for traffic anomaly and user behavior monitoring.

Restrictions and guidelines: Protocol packet rate limit

You can configure both protocol-based and flow-based protocol packet rate limit for the same protocol. The device first performs flow-based protocol packet rate limit and then performs protocol-based packet rate limit.

Procedure

1.     Enter system view.

system-view

2.     Enable packet rate limit.

anti-attack enable

By default, packet rate limit is disabled.

3.     Enable packet rate limit for a specific protocol or all protocols.

anti-attack protocol { all | protocol } enable

By default, packet rate limit is disabled for all protocols.

4.     (Optional.) Set the maximum transmission rate for a protocol.

anti-attack protocol protocol threshold rate-limit

The default settings vary by device model.

To display the default setting for a protocol, execute the undo anti-attack protocol threshold and display anti-attack protocol commands in turn.

5.     Enable flow-based packet rate limit for a protocol and set the maximum transmission rate per flow.

anti-attack protocol protocol flow-threshold flow-rate-limit

By default, flow-based packet rate limit is disabled for all protocols.

This step is required only for flow-based packet rate limit.

Verifying and maintaining protocol packet rate limit

To display protocol packet rate limit information, execute the following command in any view:

display anti-attack protocol [ protocol ]

Protocol packet rate limit configuration examples

Example: Configuring protocol-based protocol packet rate limit

Network configuration

Configure protocol packet rate limit for ARP on the AC. Set the maximum transmission rate to 1000 packets per second.

Figure 1 Network diagram

 

Procedure

# Enable packet rate limit.

<AC> system-view

[AC] anti-attack enable

# Enable packet rate limit for ARP.

[AC] anti-attack protocol arp enable

# Set the maximum transmission rate to 1000 packets per second for ARP.

[AC] anti-attack protocol arp threshold 1000

Verifying the configuration

# Display packet rate limit information about ARP after Client 1 and Client 2 are connected.

[AC] display anti-attack protocol arp

Slot 1:

                        Anti-attack statistics

Protocol       anti-attack Priority Limit(pps)  Rate(pps) Passed    Dropped

arp            enable      1        1000        0         17907     0

 

arp Flow-limit is not enable.

Example: Configuring flow-based protocol packet rate limit

Network configuration

Configure flow-based protocol packet rate limit for ARP on the AC. Set the maximum transmission rate per flow to 50 packets per second.

Figure 2 Network diagram

 

Procedure

# Enable packet rate limit.

<AC> system-view

[AC] anti-attack enable

# Enable packet rate limit for ARP.

[AC] anti-attack protocol arp enable

# Enable flow-based packet rate limit for ARP and set the maximum transmission rate per flow to 50 packets per second.

[AC] anti-attack protocol arp flow-threshold 50

Verifying the configuration

# Display packet rate limit information about ARP after Client 1 and Client 2 are connected.

[AC] display anti-attack protocol arp

Slot 1:

                        Anti-attack statistics

Protocol       anti-attack Priority Limit(pps)  Rate(pps) Passed    Dropped

arp            enable      1        1024        0         17907     0

FlowSource              FlowLimit(pps)    FlowRate(pps)   Passed    Dropped

00e0-fc12-7723          50                0               2         0

0011-e212-8801          50                0               17905     0