User's Manual

Configuration Guide of XGS-5240-Series
48-5
48.3 The Number Limitation Function of MAC and I
P in Port, VLAN Typical Examples
Fig 4-1 The Number Limitation of MAC and IP in Port, VLAN Typical Configuration Exa
mple
In the network topology above, SWITCH B connects to many PC users, before ena
bling the number limitation function of MAC and IP in Port, VLAN, if the system hardw
are has no other limitation, SWTICH A and SWTICH B can get the MAC, ARP, ND list
entries of all the PC, so limiting the MAC, ARP list entry can avoid DOS attack to a
certain extent. When malicious users frequently do MAC, ARP cheating, it will be easy
for them to fill the MAC, ARP list entries of the switch, causing successful DOS attack
s. Limiting the MAC, ARP, ND list entry can prevent DOS attack.
On port 1/0/1 of SWITCH A, set the max number can be learnt of dynamic MAC
address as 20, dynamic ARP address as 20, NEIGHBOR list entry as 10. In VLAN 1,
set the max number of dynamic MAC address as 30, of dynamic ARP address as 30,
NEIGHBOR list entry as 20.
SWITCH A configuration task sequence:
Switch (config)#interface ethernet 1/0/1
Switch (Config-If-Ethernet1/0/1)#switchport mac-address dynamic maximum 20
Switch (Config-If-Ethernet1/0/1)#switchport arp dynamic maximum 20
Switch (Config-If-Ethernet1/0/1)#switchport nd dynamic maximum 10
Switch (Config-if-Vlan1)#vlan mac-address dynamic maximum 30
SWITCH A
SWITCH B
PC PC PC PC PC
………