Allied Telesis AT-S63 - Manual (Page 374)

Chapter 17: Denial of Service Defense
374 Section II: Advanced Operations
The following is a overview of how the process takes place. This example
assumes that you have activated the feature on port 4, which is connected
to a device local to your network, and that you specified port 1 as the
uplink port, which is connected to the device that leads outside your
network. The steps below review what happens when an ingress IP
packet from the local device arrives on port 4:
1. When port 4 receives an ingress IP packet with a destination MAC
address learned on uplink port 1, it examines the packet’s source IP
address.
2. If the source IP address is not local to the network, it discards the
packet because it assumes that a packet with an IP address that is not
local to the network should not be appearing on a port that is not an
uplink port. This protects against the possibility of a Land attack
originating from within your network.
3. If the source IP address is local to the network, the port forwards the
packet to uplink port 1.
Below is a review of how the process takes place when an ingress IP
packet arrives on uplink port 1 that is destined for port 4:
1. When uplink port 1 receives an ingress IP packet with a destination
MAC address that was learned on port 4, it examines the packet’s
source IP address before forwarding the packet.
2. If the source IP address is local to the network, uplink port 1 does not
forward the packet to port 4 because it assumes that a packet with a
source IP address that is local to the network should not be entering
the network from outside the network on the uplink port.
3. If the source IP address is not local to the network, port 1 forwards the
packet to port 4.
The following guidelines apply to using this defense mechanism:
ˆ If you choose to use it, Allied Telesyn recommends activating it on all
ports on the switch, including the uplink port.
ˆ You can specify only one uplink port.
ˆ You must specify the IP address of one of the network nodes,
preferably the lowest IP address, and a mask.
This form of defense is not CPU intensive. Activating it on all ports should
not affect switch behavior.