X480 bcast flood

[Alexandr_P]

Hi, all!

Have X480 as border.
Yesterday begin big bcast flood in local network.
Investigate show that it was scanning for local net from Internet, so IP addresses which wasn't in IP-ARP table was asked by X480 - ARP who is xx.xx.xx.xx in local. As there big local network, and a lot of IP-addresses wasn't active - X480 made big bcast flood.

As workaroung we can
- increase time of keeping arp in table

Any more ideas?

I receive advice - to make arp-passive mode (X480 transmit bcast arp query only when client from local net give arp query) - how I can configure this?

Thank you!

[Alexandr_P]

Thank's for all!

I thnk it would be the best decision.

[Jarek]

They using dynamic IP addresses or static ?

Maybe you can use ip-security function.
When host get address via switch relay, switch creates a ip-security dhcp-snooping entries.
This can add a static arp also with ip-security arp learning learn-from-dhcp

[Alexandr_P]

Via DHCP from external server, not switch dhcp.

[Jarek]

You have customers that obtaining address via DHCP or use a static IP ?

--
Jarek

[Alexandr_P]

I can't deny arp requests - because in my case swich work correct.
But in case when somebody scan my network, disconnected clients -> arp table in X480 haven't their MAC/IP records -> send a lot of bcast arp-who_is messages -> big load of network