Configuring a Rule for Sending Packets to the CPU

Procedure

1. Run system-view

   The system view is displayed.

2. Configure a rule for sending packets to the CPU.

   Run cpu-defend policy policy-name

   The attack defense policy view is displayed.

   Configure a rate limit for protocol packets or a rate limit after ALP is enabled in the attack defense policy view.

   • Configure rate limits for protocol packets.

     The action to be performed on protocol packets sent to the CPU can be car or deny. When you configure the action to be performed on packets of the same protocol, the latest configuration takes effect.

     • Run car { packet-type packet-type | user-defined-flow flow-id } cir cir-value [ cbs cbs-value ]

       The CIR and CBS values for packets sent to the CPU are set.

       By default, the CIR value for user-defined flows is 64 kbit/s. You can run the display cpu-defend configuration command to check the CAR values for protocol packets.

     • Run deny { packet-type packet-type | user-defined-flow flow-id }

       The action taken for the packets sent to the CPU is set to deny.

       By default, the switch does not discard packets sent to the CPU. Instead, the switch limits the rate of user-defined flows and packets sent to the CPU based on the default rate. You can run the display cpu-defend configuration command to check the CAR values of each type of packets.

   • Configure a rate limit after ALP is enabled.

     1. Run linkup-car packet-type { bgp | bgp4plus | ftp | ftpv6 | http | https | ike | ip-cloud | ipsec-esp | isis | ospf | ospfv3 | ssh | telnet | tftp } cir cir-value [ cbs cbs-value ]

        The CAR values for protocol packets, including the CIR and CBS values, are set.

        Table 1 lists the default CIR and CBS values for the setup of BGP, BGP4+, FTP, IPv6 FTP, HTTP, HTTPS, IKE, IPSEC-ESP, ISIS, OSPF, OSPFv3, SSH, TELNET, and TFTP connections; the CIR and CBS for sending packets of IP-CLOUD connections are 2048 kbit/s and 385024 bytes respectively.

        Table 1 Default CIR and CBS values

        Product	CIR	CBS
        S5720-LI, S5720S-LI, S6720-LI, S6720S-LI	FTP, IPv6 FTP, HTTP, SSH, TFTP: 1024 kbit/s IKE: 64 kbit/s IPSEC-ESP: 320 kbit/s OSPF: 512 kbit/s Telnet: 64 kbit/s	FTP, IPv6 FTP, HTTP, SSH, TFTP: 192512 bytes IKE: 12032 bytes IPSEC-ESP: 60160 bytes OSPF: 96256 bytes Telnet: 12032 bytes
        S5720-SI, S5720I-SI, S5720S-SI	FTP, IPv6 FTP, HTTP, SSH, TFTP: 1024 kbit/s IKE: 64 kbit/s IPSEC-ESP: 320 kbit/s Telnet: 64 kbit/s	FTP, IPv6 FTP, HTTP, SSH, TFTP: 192512 bytes IKE: 12032 bytes IPSEC-ESP: 60160 bytes Telnet: 12032 bytes
        S5735-L, S5735S-L, S5735S-L-M	FTP, IPv6 FTP, HTTP, HTTPS, SSH, TFTP: 1536kbit/s IKE: 64kbit/s IPSEC-ESP: 800kbit/s OSPF: 512kbit/s TELNET: 64kbit/s	FTP, IPv6 FTP, HTTP, HTTPS, SSH, TFTP: 288768bytes IKE: 12032bytes IPSEC-ESP: 150400bytes OSPF: 96256bytes TELNET: 12032bytes
        S5735-S, S5735S-S, S5735-S-I	BGP: 1024kbit/s FTP, IPv6 FTP, HTTP, HTTPS, SSH, TFTP: 1536kbit/s IKE: 64kbit/s IPSEC-ESP: 800kbit/s OSPF: 512kbit/s TELNET: 64kbit/s	BGP: 192512bytes FTP, IPv6 FTP, HTTP, HTTPS, SSH, TFTP: 288768bytes IKE: 12032bytes IPSEC-ESP: 150400bytes OSPF: 96256bytes TELNET: 12032bytes
        S2720-EI	FTP, IPv6 FTP, HTTP, SSH, TFTP: 1024 kbit/s IKE: 64 kbit/s IPSEC-ESP: 320 kbit/s OSPF: 512 kbit/s Telnet: 64 kbit/s	FTP, IPv6 FTP, HTTP, SSH, TFTP: 192512 bytes IKE: 12032 bytes IPSEC-ESP: 60160 bytes OSPF: 96256 bytes Telnet: 12032 bytes
        S5730-SI, S5730S-EI, S6720-SI, S6720S-SI	BGP: 1024 kbit/s FTP, IPv6 FTP, HTTP, SSH, TFTP: 1536 kbit/s IKE: 64 kbit/s IPSEC-ESP: 4096 kbit/s OSPF: 512 kbit/s Telnet: 64 kbit/s	BGP: 192512 bytes FTP, IPv6 FTP, HTTP, SSH, TFTP: 288768 bytes IKE: 12032 bytes IPSEC-ESP: 770048 bytes OSPF: 96256 bytes Telnet: 12032 bytes
        S5720-EI, S6720-EI, S6720S-EI	BGP: 1024 kbit/s FTP, IPv6 FTP, HTTP, HTTPS, SSH, TFTP: 1536 kbit/s IKE: 64 kbit/s IPSEC-ESP: 4096 kbit/s BGP4+, ISIS, OSPF, OSPFv3: 512 kbit/s Telnet: 64 kbit/s	BGP: 192512 bytes FTP, IPv6 FTP, HTTP, HTTPS, SSH, TFTP: 288768 bytes IKE: 12032 bytes IPSEC-ESP: 770048 bytes BGP4+, ISIS, OSPF, OSPFv3: 96256 bytes Telnet: 12032 bytes
        S5720-HI, S5730-HI, S5731-H, S5731S-H, S5731-S, S5731S-S, S6720-HI, S5732-H, S6730-H, S6730S-H, S6730-S, S6730S-S	BGP: 1024kbit/s FTP, IPv6 FTP, HTTP, HTTPS, SSH, TFTP: 1536kbit/s IPSEC-ESP: 800kbit/s BGP4+, ISIS, OSPF, OSPFv3: 512kbit/s TELNET: 64kbit/s	BGP: 192512bytes FTP, IPv6 FTP, HTTP, HTTPS, SSH, TFTP: 288768bytes IPSEC-ESP: 150400bytes BGP4+, ISIS, OSPF, OSPFv3: 96256bytes TELNET: 12032bytes

        

        • A shared CAR value for packets of FTP, SSH, TFTP connections can be set on S2720-EI, S5720I-SI, S5720-LI, S5735-L, S5735S-L, S5735S-L-M, S5720S-LI, S5720S-SI, S5720-SI, S5735-S, S5735S-S, S5735-S-I, S5730S-EI, S5730-SI, S6720-LI, S6720S-LI, S6720S-SI, and S6720-SI. For example, the linkup-car packet-type ftp cir cir-value [ cbs cbs-value ] command specifies the CAR value for FTP packets when an FTP connection is set up, and also specifies the CAR value for packets of SSH, TFTP connections.

     2. Run quit

        Return to the system view.

     3. Run cpu-defend application-apperceive enable

        Globally ALP is enabled.

        By default, globally ALP is enabled.

     4. Run cpu-defend application-apperceive { bgp | bgp4plus | ftp | ftpv6 | http | https | ike | ip-cloud | ipsec-esp | isis | ospf | ospfv3 | ssh | telnet | tftp } enable

        ALP of protocol packets is enabled.

        By default, ALP is enabled on FTP, IPv6 FTP, HTTP, HTTPS, IP-CLOUD, IKE, IPSEC-ESP, SSH, TELNET, and TFTP packets and disabled on BGP, BGP4+, ISIS, OSPF, and OSPFv3 packets.

        

        After ALP is enabled for HTTPS, the CIR value (transmission rate) is automatically increased to ensure high-speed file transmission between the Web NMS and switch.