ipv4 destination-unreachable drop
Function
The ipv4 destination-unreachable drop command enables the function of discarding IP packets that match no routing entry.
The undo ipv4 destination-unreachable drop command disables the function of discarding IP packets that match no routing entry.
By default, the function of discarding IP packets that match no routing entry is enabled.
Format
ipv4 destination-unreachable drop
undo ipv4 destination-unreachable drop
Only the S5720-EI, S5720-HI, S5720I-SI, S5720S-SI, S5720-SI, S5735-L, S5735S-L, S5735S-L-M, S5735-S, S5735S-S, S5735-S-I, S5730-HI, S5730S-EI, S5730-SI, S5731-H, S5731-S, S5731S-H, S5731S-S, S5732-H, S6720-EI, S6720-HI, S6720-LI, S6720S-EI, S6720S-LI, S6720S-SI, S6720-SI, S6730-H, S6730S-H, S6730-S, and S6730S-S support this command.
Usage Guidelines
Usage Scenario
If the switch receives an IP packet that matches no routing entry in the local routing table, it sends the packet to the CPU. If a lot of IP packets match no routing entry because of an attack or incorrect network configuration, the CPU is busy. To prevent this problem, run the ipv4 destination-unreachable drop command to configure the switch to discard these packets.
Precautions
If you run the ipv4 destination-unreachable drop command, the switch does not respond to ICMP error packets when a route fails to match the routing policies. To enable the switch to respond to these ICMP packets, you need to run the undo ipv4 destination-unreachable drop command.
On the S5720-EI, S6720-EI, and S6720S-EI, when both the ipv4 destination-unreachable drop command and the traffic policy command are run, both the drop action and the redirection action take effect. The ICMP redirection packets are discarded because the drop action has a higher priority than the redirection action. This leads to a redirection failure for ICMP packets. To make the redirection action for ICMP packets effective, run the undo ipv4 destination-unreachable drop command to disable the drop action. However, disabling the drop action will degrade the attack defense performance of the system. You must configure the two actions properly according to the network requirements.
For the S6720-EI and S6720S-EI, if the resource allocation mode is set to enhanced-ipv4 or ipv4-ipv6 6:1 using the assign resource-mode command, the ipv4 destination-unreachable drop command does not take effect.