Hello, everybody!
This is the second and last article about the DoS attack and configuration process on the OLT. In the first article, I showed the CPU load of the control and service boards in a normal state. Also, I showed the command to activate the anti-dos attack, as well as display all security configuration on OLT.
We can set the policy for processing packets. In this case, the system will check all packets and it can permit or deny sending packets to the CPU. Without these policies, the system will not checks packets and will send protocol packets to the CPU. The system can't recognize the attack.
Figure 1. DoS attack
(HCIP-Access V2.5 Training Material)
With next command for configuration a packet processing policy, system will discard all protocol packets:
TEST(config)#security anti-dos control-packet policy
{ deny<K>|permit<K> }:deny
Command:
security anti-dos control-packet policy deny
Command to configure a packet processing policy where the system will allow all protocol packets:
TEST(config)#security anti-dos control-packet policy
{ deny<K>|permit<K> }:permit
Command:
security anti-dos control-packet policy permit
In this case, we enabled to allow all protocol packets. But, we can define the rate threshold for sending protocol packets. OLT supports five rate thresholds for sending packets for IGMP, DHCP, ARP, PPPoE, and total speed for all protocol packets.
If packets arrive at the OLT CPU at a higher speed than the defined speed, the system will the alarm that there is a DoS attack and discard packets.
TEST(config)#security anti-dos control-packet rate
{ frameid/slotid/portid<S><Length 1-15> }:0/1/0
{ default<K>|ont<K>|value<U><0,63> }:ont 0
{ default<K>|gemport<K>|value<U><0,254> }:gemport
{ gemindex<U><0,1023> }:1
{ default<K>|value<U><0,254> }:60
Command:
security anti-dos control-packet rate 0/1/0 ont 0 gemport 1 60
We can simulate a DoS attack in the laboratory. For that, we would need a PC and an attacker tool such as Seal attacker, Hping3, mz, pser etc.
Thank you!
Reference: - HCIP-Access V2.5 Training Material
