arp攻击防范(国外英文资料).doc

arp攻击防范 Second volume (DAI heart method) The second volume is more complicated, which requires the refiner to have deeper internal force, and the practice of the 2nd chakra is accelerated. The second volume requires some innate conditions: DHCPserver one, CISCO4506 (only for example), CISCO3550\2950. First: set up DHCPserver This is the basis of the second volume, which can be built using Windows or Linux or UNIX. Im lazy, just use Windows. Basically, how many vlans are there to do in DHCPserver. But one thing is that server doesnt need to do DHCP. Type 2: enable DHCPrelay on 4506 The Switch # ServiceDhcp (Config) Switch (Config) # Ip Dhcp Relay Information check Number three: define DHCPserver for each VLAN Under the VLAN virtual interface Interface Vlan2 (this is the VLAN from the server) Description the server ! Interface Vlan3 IP address 10.167.89.62255.255.192 IP helper ‐ address10.167.88.7 (this is the command to add DHCP servers to the VLAN) IP pim dense - mode ! Type 4: start IP DHCP snooping IP DHCP snooping vlan3 ‐ 7, 9101 ‐ 105 (which VLANs VLAN is required to write on which VLAN) No IP DHCP snooping information option IP DHCP snooping This step is based on my understanding of the relationship between an IP and a MAC, but the source of this correspondence is from DHCP. Number five: start IP arp inspection and record the day (logging is important, and you need to find the machine that sends the arp exception in the network segment.) IP arp inspection vlan 3 ‐ 79,101,200 (set the vlan to enable IP arp inspection) The IP arp inspection log is 1024, which is not a word, literally. IP arp inspection log ‐ buffer logs 1024 interval 10 IP arp inspection limitrate30 (this is setting the arp value, more than this threshold causes the port to be DOWN because of the error of the err-error) This is I think the most important thing is the last one, how can guarantee the stable operation of the network, depends on it, the port problems will turn that off, lest affect V