1. Prevent ARP spoofing attacks in the LAN Phenomenon
: Some illegal PCs in the intranet pretend to be gateways to respond to ARP request packets sent by normal PCs, causing the computers to send data, and all traffic enters the illegal PCs, causing users to be unable to access the Internet.
Operation: Do gateway binding on the layer 3 switch, important server, computer ARP binding
computer binding gateway ARP, domain controller, important server address
Huawei switch arp binding command:
#arp static 10.251.XX XXXX-XXXX-XXXX
Computer terminal arp binding command:
query netsh interface ipv4 show in
netsh -c "interface ipv4" add neighbors idx "10.251.XX" "10.251.XX" (the idx here is filled in according to the result of your query
) DHCP attack on the network
Phenomenon: In the internal network management, employees often access routers to connect to the LAN, resulting in multiple DHCP address servers in the enterprise. If the computer receives an illegal DHCP server address IP, the data will be intercepted, and some business websites will not be accessible.
Operation: We can configure the DHCP trust port, and the configuration is generally configured at the access layer, because the data forwarding and core layer are generally in the computer room. After an untrusted port is enabled, the DHCP OFFER and DHCP REQUEST packets received by the port will be discarded directly to avoid other illegal DHCP servers under the untrusted port.
Configuration command:
in global mode:
dhcp
dhcp snooping enable
In port mode:
dhcp snooping trusted
3. Prevent the loop
phenomenon in the intranet: In the local area network, when some employees join the network, they make a wrong connection and connect both ends of the network cable to the unified switch, which makes the switch port loop. The traffic on the port will be abnormally high. The network speed of the LAN is slow, and the card is turned on, and the network management personnel enter the switch and the card is also stuck.
Operation: We can configure the loopback-detect loop prevention command of Huawei switches.
Configuration command:
In global mode:
# loopback-detect enable
In interface mode:
# interface GigabitEthernet0/0/1
#loopback-detect action shutdown -----(if a loop is detected on this interface, port shutdown will be executed)
# interface GigabitEthernet0/0/2
#loopback-detect action shutdown
View environment detection information
#display loopback-detect