技术知识库

为了对ARP泛洪攻击进行防范、检测和解决,在交换机上配置ARP安全功能。 
适用产品和版本 
CE12800/CE6800/CE5800系列产品V100R001C00或更高版本。 
组网需求 
如图2-36所示,Switch作为网关通过接口10GE1/0/3连接一台服务器,通过接口 
10GE1/0/1、10GE1/0/2连接VLAN10和VLAN20下的用户。网络中存在以下ARP泛洪攻 
击: 
l Switch收到大量目的IP地址不可达的IP报文进行ARP泛洪攻击,造成Switch的CPU负 
荷过重。 
l MAC地址为1–1–1的用户短时间内向Switch发送大量源IP地址变化MAC地址固定 
的ARP报文进行ARP泛洪攻击,造成Switch的ARP表资源被耗尽以及CPU进程繁 
忙,影响到正常业务的处理。 
l IP地址为9.9.9.2的用户短时间内向Switch发送大量源IP地址固定的ARP报文进行ARP 
泛洪攻击,造成Switch的CPU进程繁忙,影响到正常业务的处理。 
管理员希望能够防止上述ARP攻击行为,为用户提供更安全的网络环境和更稳定的网络 
服务。

图 2-36 配置ARP安全组网图


配置思路 
采用如下思路在Switch上进行配置: 
1. 配置根据源IP地址进行ARP Miss消息限速,避免设备的资源浪费在处理ARP Miss消 
息上,保证用户的其他业务能够正常运行。 
l 防止用户侧存在攻击者发出大量目的IP地址不可达的IP报文而形成ARP泛洪攻 
击。 
l 保证设备可以正常处理服务器发出的大量ARP Miss消息,避免因丢弃此类报文 
而造成网络无法正常通信。 
2. 配置基于接口的ARP表项限制,防止该接口下所接入的某一用户发起ARP攻击时导 
致设备的ARP表资源都被耗尽。 
3. 分别根据源MAC地址、源IP地址配置ARP限速功能,防止用户发送的大量源MAC 
地址固定、源IP地址固定的ARP报文形成的ARP泛洪攻击,避免CPU进程繁忙而影 
响到CPU处理正常业务。 
操作步骤 
步骤1 创建VLAN,将接口加入到VLAN中,并配置VLANIF接口 
# 创建VLAN10、VLAN20和VLAN30,并将接口10GE1/0/1加入VLAN10中,接口 
10GE1/0/2加入VLAN20中,接口10GE1/0/3加入VLAN30中。 
<HUAWEI> system-view 
[~HUAWEI] sysname Switch 
[*HUAWEI] commit 
[~Switch] vlan batch 10 20 30

[~Switch] interface 10ge 1/0/1 
[~Switch-10GE1/0/1] port link-type trunk 
[*Switch-10GE1/0/1] port trunk allow-pass vlan 10 
[*Switch-10GE1/0/1] quit 
[*Switch] interface 10ge 1/0/2 
[*Switch-10GE1/0/2] port link-type trunk 
[*Switch-10GE1/0/2] port trunk allow-pass vlan 20 
[*Switch-10GE1/0/2] quit 
[*Switch] interface 10ge 1/0/3 
[*Switch-10GE1/0/3] port link-type trunk 
[*Switch-10GE1/0/3] port trunk allow-pass vlan 30 
[*Switch-10GE1/0/3] quit 
[*Switch] commit 
# 创建接口VLANIF10、VLANIF20、VLANIF30,配置各VLANIF接口的IP地址。 
[~Switch] interface vlanif 10 
[~Switch-Vlanif10] ip address 8.8.8.1 24 
[*Switch-Vlanif10] quit 
[*Switch] interface vlanif 20 
[*Switch-Vlanif20] ip address 9.9.9.1 24 
[*Switch-Vlanif20] quit 
[*Switch] interface vlanif 30 
[*Switch-Vlanif30] ip address 10.10.10.3 24 
[*Switch-Vlanif30] quit 
[*Switch] commit 
步骤2 配置根据源IP地址进行ARP Miss消息限速 
# 配置对Server(IP地址为10.10.10.2)的ARP Miss消息进行限速,允许Switch每秒最多 
处理该IP地址触发的40个ARP Miss消息;对于其他用户,允许Switch每秒最多处理同一 
个源IP地址触发的20个ARP Miss消息。 
[~Switch] arp miss anti-attack rate-limit source-ip maximum 20 
[*Switch] arp miss anti-attack rate-limit source-ip 10.10.10.2 maximum 40 
[*Switch] commit 
步骤3 配置基于接口的ARP表项限制 
# 配置接口10GE1/0/1最多可以学习到20个动态ARP表项。 
[~Switch] interface 10ge 1/0/1 
[~Switch-10GE1/0/1] arp limit vlan 10 20 
[*Switch-10GE1/0/1] quit 
[*Switch] commit 
步骤4 分别根据源MAC地址、源IP地址配置ARP限速功能 
# 配置对用户(MAC地址为1–1–1)进行ARP报文限速,每秒最多只允许10个该MAC 
地址的ARP报文通过。 
[~Switch] arp anti-attack rate-limit source-mac 1-1-1 maximum 10 
# 配置对用户(IP地址为9.9.9.2)进行ARP报文限速,每秒最多只允许10个该IP地址的 
ARP报文通过。 
[*Switch] arp anti-attack rate-limit source-ip 9.9.9.2 maximum 10 
[*Switch] commit 
----结束 
验证 
1. 执行命令display arp anti-attack rate-limit,查看ARP报文限速的配置情况。

[~Switch] display arp anti-attack rate-limit 
Global ARP packet rate limit (pps)        : --                                  
Suppress Rate of each destination IP (pps): --                                  
                                                                                
VLAN ID            Suppress Rate(pps)                                           
------------------------------------------------------------------------------- 
All                          --                                                 
------------------------------------------------------------------------------- 
Total: 0, spec of rate-limit configuration for VLAN is 1024.                    
                                                                                
Source IP          Suppress Rate(pps)                                           
------------------------------------------------------------------------------- 
9.9.9.2                      10                                                 
Other                        --                                                 
------------------------------------------------------------------------------- 
Total: 1, spec of rate-limit configuration for Source IP is 1024.               
                                                                                
Source MAC         Suppress Rate(pps)                                           
------------------------------------------------------------------------------- 
0001-0001-0001               10                                                 
Other                        --                                                 
------------------------------------------------------------------------------- 
Total: 1, spec of rate-limit configuration for Source MAC is 1024.              
2. 执行命令display arp limit,查看接口可以学习到的动态ARP表项数目的最大值。以 
接口10GE1/0/1为例。 
[~Switch] display arp limit interface 10ge 1/0/1 
Interface                         VLAN       Limit      Learnt                 
---------------------------------------------------------------------------     
10GE1/0/1                           10          20           0                 
---------------------------------------------------------------------------     
Total:1                                                                        
3. 执行命令display arp miss anti-attack rate-limit,查看ARP Miss消息限速的配置情 
况。 
该命令回显信息在V100R001版本和V100R002版本显示格式不同,此处以V100R002 
版本为例。 
[~Switch] display arp miss anti-attack rate-limit 
Global ARP miss rate limit (pps)          : --                                  
VLAN ID            Suppress Rate(pps)                                           
------------------------------------------------------------------------------- 
All                          --                                                 
------------------------------------------------------------------------------- 
Total: 0, spec of rate-limit configuration for VLAN is 1024.                    
                                                                                
Source IP          Suppress Rate(pps)                                           
------------------------------------------------------------------------------- 
10.10.10.2/32                40                                                 
Other                        20                                                 
------------------------------------------------------------------------------- 
Total: 1, spec of rate-limit configuration for Source IP is 1024.               
4. 执行命令display arp packet statistics,查看ARP处理的报文统计数据。 
该命令回显信息在V100R001版本和V100R002版本显示格式不同,此处以V100R002 
版本为例。 
[~Switch] display arp packet statistics 
ARP Packets Received                                                            
  Total:                              200                                       
  Learnt Count:                         1                                       
  Discard For Entry Limit:              0                                       
  Discard For Speed Limit:              0                                       
  Discard For Proxy Suppress:           0                                       
  Discard For Other:                    0                                       
ARP Packets Sent                

   Total:                              476                                       
  Request:                            312                                       
  Reply:                              164                                       
  Gratuitous ARP:                     311                                       
ARP-Miss Message Received                                                       
  Total:                               12                                       
  Discard For Speed Limit:              0                                       
  Discard For Other:                    0                                       
当Switch上产生了ARP报文和ARP Miss消息丢弃计数,表明ARP安全功能(防范 
ARP泛洪攻击)已经生效。 
配置文件 
#                                                                               
sysname Switch 
#                                                                               
vlan batch 10 20 30 
#                                                                               
arp miss anti-attack rate-limit source-ip maximum 20                            
arp anti-attack rate-limit source-ip 9.9.9.2 maximum 10                         
arp miss anti-attack rate-limit source-ip 10.10.10.2 maximum 40                 
arp anti-attack rate-limit source-mac 0001-0001-0001 maximum 10                 

interface Vlanif10                                                              
ip address 8.8.8.1 255.255.255.0                                               
#   
interface Vlanif20                                                              
ip address 9.9.9.1 255.255.255.0                                               
#   
interface Vlanif30                                                              
ip address 10.10.10.3 255.255.255.0                                               
#   
interface 10GE1/0/1                                                             
port link-type trunk                                                           
port trunk allow-pass vlan 10                                                  
arp limit vlan 10 20                                                           

interface 10GE1/0/2                                                             
port link-type trunk                                                           
port trunk allow-pass vlan 20                                            
#                                                                               
interface 10GE1/0/3                                                             
port link-type trunk                                                           
port trunk allow-pass vlan 30                                             
#   
return


提交成功!非常感谢您的反馈,我们会继续努力做到更好!

这条文档是否有帮助解决问题?

非常抱歉未能帮助到您。为了给您提供更好的服务,我们很需要您进一步的反馈信息:

在文档使用中是否遇到以下问题: