X480 bcast flood

[Alexandr_P]

Hi, all!

Have X480 as border.
Yesterday begin big bcast flood in local network.
Investigate show that it was scanning for local net from Internet, so IP addresses which wasn't in IP-ARP table was asked by X480 - ARP who is xx.xx.xx.xx in local. As there big local network, and a lot of IP-addresses wasn't active - X480 made big bcast flood.

As workaroung we can
- increase time of keeping arp in table

Any more ideas?

I receive advice - to make arp-passive mode (X480 transmit bcast arp query only when client from local net give arp query) - how I can configure this?

Thank you!

[Sergey_Okun]

You can try access-list with the action "deny-cpu". Like this:

code:

 x460.3 # show policy CoPP Policies at Policy Server: Policy: CoPP entry arp {  if match all {      ethernet-type 0x806 ; } then {     permit  ; } } entry ssh {  if match all {      source-zone zone-mgm ;     protocol tcp ;     destination-port 22 ; } then {     permit  ; } entry bgp_src {  if match all {      source-zone zone-bgp ;     protocol tcp ;     source-port 179 ; } then {     permit  ; } ##########  [skip] ########## Other protocols entry deny_other {  if match all {  } then {     deny-cpu  ; } } 

code:

 x460 # show configuration | include CoPP configure access-list CoPP any ingress 

[Jarek]

Hi,

can you use static ARP ? For example you can check ip-security function like "learn ARP from DHCP".

--
Jarek