Configuration example
Network requirements
As shown in Figure 105, a LAN contains two areas: an R&D area in VLAN 10 and an office area in VLAN 20. The two areas connect to the gateway (Device) through an access switch.
A large number of ARP requests are detected in the office area and are considered as the consequence of an IP flood attack. To prevent such attacks, configure ARP source suppression and ARP black hole routing.
Figure 105: Network diagram
Configuration considerations
If the attacking packets have the same source address, you can enable the ARP source suppression function with the following steps:
Enable ARP source suppression.
Set the threshold for ARP packets from the same source address to 100. If the number of ARP requests sourced from the same IP address in 5 seconds exceeds 100, the device suppresses the IP packets sourced from this IP address from triggering any ARP requests within the following 5 seconds.
If the attacking packets have different source addresses, enable the ARP black hole routing function on the device.
Configuration procedure
Enable ARP source suppression on the device and set the threshold for ARP packets from the same source address to 100.
<Device> system-view [Device] arp source-suppression enable [Device] arp source-suppression limit 100
Enable ARP black hole routing on the device.
<Device> system-view [Device] arp resolving-route enable