Qtech QSW-8200-52T-AC — настройка предотвращения ARP-сканирования: руководство пользователя [34/47]

Превью страниц Страница 34 / 47

User Manual

Chapter 2. Commands for ARP Scanning Prevention 34

www.qtech.ru

 Function: Set the threshold of received messages of the IP-based ARP scanning

prevention. If the rate of received ARP messages exceeds the threshold, the IP

messages from this IP will be blocked. The unit is packet/second. The “no anti-arpscan

ip-based threshold” command will reset the default value, 3 packets/second.

 Parameters: rate threshold, ranging from 1 to 200.

 Default Settings: 3 packets/second.

 Command Mode: Global configuration mode

 User Guide: The threshold of port-based ARP scanning prevention should be larger than

the threshold of IP-based ARP scanning prevention, or, the IP-based ARP scanning

prevention will fail.

 Example: Set the threshold of IP-based ARP scanning prevention as 6 packets/second.

 Switch(config)#anti-arpscan ip-based threshold 6

2.4 anti-arpscan trust

 Command: anti-arpscan trust [port | supertrust-port]

 no anti-arpscan trust [port | supertrust-port]

 Function: Configure a port as a trusted port or a super trusted port;” no anti-arpscan

trust <port | supertrust-port>”command will reset the port as an untrusted port.

 Parameters: None.

 Default Settings: By default all the ports are non- trustful.

 Command Mode: Port configuration mode

 User Guide: If a port is configured as a trusted port, then the ARP scanning prevention

function will not deal with this port, even if the rate of received ARP messages exceeds

the set threshold, this port will not be closed, but the non- trustful IP of this port will

still be checked. If a port is set as a super non- trustful port, then neither the port nor

the IP of the port will be dealt with. If the port is already closed by ARP scanning

prevention, it will be opened right after being set as a trusted port.

 When remotely managing a switch with a method like telnet, users should set the

uplink port as a Super Trust port before enabling anti-ARP-scan function, preventing the

port from being shutdown because of receiving too many ARP messages. After the anti-

ARP-scan function is disabled, this port will be reset to its default attribute, that is,

Untrust port.

 Example: Set port ethernet 1/0/5 of the switch as a trusted port.

 Switch(config)#in e1/0/5

 Switch(Config-If-Ethernet1/0/5)# anti-arpscan trust port

2.5 anti-arpscan trust ip

 Command: anti-arpscan trust ip <ip-address> [<netmask>]

 no anti-arpscan trust ip <ip-address> [<netmask>]