Storm control
A traffic storm - a flood of broadcast, multicast or unknown-unicast frames, from a loop or an attack - can swamp a LAN. Storm control watches the rate on a port and, past a threshold (a percentage of the link), drops the excess or shuts the port down.
| Command (interface) | Does |
|---|---|
storm-control broadcast level 20 | Act when broadcasts pass 20% of the link |
storm-control multicast level 30 | Same for multicast |
storm-control action shutdown | Err-disable the port on a storm (default: just drop) |
show storm-control | Levels and current state |
In NetLab
▶ SW1 SW1>enable SW1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. SW1(config)#interface fa0/1 SW1(config-if)#storm-control broadcast level 20.00 SW1(config-if)#storm-control action shutdown SW1(config-if)#end *Mar 1 00:00:06.000: %SYS-5-CONFIG_I: Configured from console by console SW1#show storm-control Interface Filter State Upper Lower Current Action --------- ------------- ----------- ----------- ----------- --------- Fa0/1 Forwarding 20.00% 20.00% 0.00% shutdown
RA guard
In IPv6, hosts find their gateway by listening for Router Advertisements (RAs). A rogue RA - from an attacker or a misconfigured PC sharing its connection - makes hosts pick the wrong gateway. RA guard drops RAs on ports where only hosts should be.
| Command | Where | Does |
|---|---|---|
ipv6 nd raguard policy HOSTS + device-role host | Global | A policy: the device here is a host |
ipv6 nd raguard attach-policy HOSTS | Interface (host ports) | Drop RAs arriving here |
In NetLab
▶ SW1 SW1>enable SW1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. SW1(config)#ipv6 nd raguard policy HOSTS SW1(config-ra-guard)#device-role host SW1(config-ra-guard)#exit SW1(config)#interface range fa0/1 - 3 SW1(config-if-range)#ipv6 nd raguard attach-policy HOSTS SW1(config-if-range)#end *Mar 1 00:00:08.000: %SYS-5-CONFIG_I: Configured from console by console SW1#show running-config | include raguard ipv6 nd raguard policy HOSTS ipv6 nd raguard attach-policy HOSTS ipv6 nd raguard attach-policy HOSTS ipv6 nd raguard attach-policy HOSTS
Tip: Leave the uplink (toward the real router) without the host policy, or give it a
device-role routerpolicy, so the legitimate RAs still get through.