Security risks of core Switches

The following describes the security risks of the core switch and some issues that need attention. As a core switch, it can support enterprise-level switches for large-scale enterprise applications with more than 500 information points.

In the actual network environment, with the continuous improvement of computer performance, attacks against switches, routers, or other computers in the network become more and more serious, and the impact becomes more and more severe. As the main device for LAN information exchange, switches, especially the core and aggregation switches, carry extremely high data traffic. In case of sudden abnormal data or attacks, they are prone to overload or downtime.

To minimize the impact of attacks, reduce the load on switches, and ensure stable LAN operation, core switch vendors have applied some security protection technologies on switches, network administrators should effectively enable and configure these technologies based on different device models to purify the LAN environment.

This article takes the Quidway series vswitches of Huawei 3COM as an example to introduce you to common security protection technologies and configuration methods in two phases. You will learn about broadcast storm control, MAC address control, DHCP control, and ACL.

Broadcast Storm Control Technology

Damage to NICs or other network interfaces, loops, damage to human interference, hacker tools, and virus transmission may cause a broadcast storm. The switch forwards a large number of broadcast frames to each port, this greatly consumes link bandwidth and hardware resources. You can set an Ethernet port or VLAN's broadcast storm suppression ratio to effectively suppress broadcast storms and avoid network congestion.

1. broadcast storm Suppression Ratio
You can use the following command to limit the amount of broadcast traffic allowed on the port. When the broadcast traffic exceeds the value set by the user, the system discards the broadcast traffic, reduces the proportion of broadcast traffic to a reasonable range, and takes the wire speed percentage of the maximum broadcast traffic on the port as a parameter.

A smaller percentage indicates a smaller percentage of broadcast traffic. When the percentage is 100, it indicates that broadcast storm suppression is not performed on the port. By default, the allowed broadcast traffic is 100%, that is, the broadcast traffic is not blocked. Configure the following in the Ethernet port view.

2. Specify the broadcast storm suppression ratio for the VLAN
Similarly, you can use the following command to set the size of the broadcast traffic allowed by a VLAN. By default, all VLANs of the system do not suppress broadcast storms, that is, the max-ratio value is 100%.

MAC address Control Technology

An Ethernet switch can use the MAC address learning function to obtain the MAC addresses of network devices connected to a port. For packets sent to these MAC addresses, the Ethernet switch can directly use hardware forwarding. If the MAC address table is too large, the forwarding Performance of the core switch may decrease.

MAC attacks use tools to generate spoofed MAC addresses and quickly fill up the MAC table of the switch. After the MAC table is filled up, the switch processes packets sent through the switch in broadcast mode, the traffic is sent to all interfaces in a flood manner. Attackers can use various sniffing tools to obtain network information.

The traffic on the TRUNK interface will also be sent to all interfaces and adjacent switches, resulting in excessive load on the switch, slow network, packet loss, and even paralysis. You can suppress MAC attacks by setting the maximum number of MAC addresses and the aging time of MAC addresses on the port.

The locking port here refers to the Ethernet port with the maximum number of MAC addresses learned. After you use the mac-address max-mac-count command on the Ethernet port to set the maximum number of addresses that can be learned by the port, the learned MAC address table items will be bound to the corresponding port.

• Describes the main differences between a SWITCH and a router.
• Analysis of Cisco layer-3 Switch stack connection
• Illustration of how a layer-3 Switch works
• Uncover important factors in Ethernet Switches
• Explain the exclusive technical advantages of vswitch Technology

If the host corresponding to a MAC address does not access the Internet for a long time or has been removed, it still occupies a MAC address table entry on the port, as a result, hosts outside the five MAC addresses cannot access the Internet. In this case, you can set the aging time of the MAC address table corresponding to the locked port to aging the MAC address table items of hosts that do not access the Internet for a long time, so that other hosts can access the Internet. By default, the aging time of the MAC address table corresponding to the locked port is 1 hour.

To enable users with valid fixed IP addresses in VLAN configured with DHCP Relay to pass the address legality check of DHCP security features, you need to use this command to add a static address table entry that corresponds to an IP address and a MAC address to a user with a fixed IP address.

If another illegal user configures a static IP address, the static IP address conflicts with a valid user's fixed IP address. The core switch that executes the DHCP Relay function can identify the illegal user, and rejects the Binding Request between the IP address of an invalid user and the MAC address.