cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
482
Views
0
Helpful
2
Replies

LAN Protection Strategy

leonardo.yata
Level 1
Level 1

Hi there!

I currently have the following scenario/topology:

- 2 Catalyst 6509 with Sup1A/MSFC/PFC interconnected with each other (HSRP configured for client's high availability). This switches acts as part of our backbone;

- Several clients connected to Catalysts (most of them with physical redundancy);

Recently, our entire infrastructure has been affected with an attack originated in one of the clients (HSRP flapping, slow networks, etc...). I can't confirm what kind of attack we was dealing but this attack generated 100Mbps of traffic into the infrastructure (note that the uplink of this client is one 100Mbps port of the switch). When we disabled the ports that connect the backbone to the client's switch, everything has normalized!

So, here goes my question:

- Applying QoS strategies (such as policing) to drop traffic on problematic or suspiscious ports can be considered a "best practice" for this situation? Or what can be done to reduce the impacts in situations like this?

Just to make things easier, we don't have budget to implement any hardware and/or software this time...

2 Replies 2

dgahm
Level 8
Level 8

That sounds like a bridge loop. Is Spanning Tree enabled on the switches for the VLANs involved?

m_zabetian
Level 1
Level 1

make sure you don't have loop on that port.

add this five command to interface connected to user

switchport port-security

switchport port-security max 3

storm-control broadcast level 2.00

spanning-tree bpdufilter enable

spanning-tree bpduguard enable

Also,

Check user NIC may be she or he have bad NIC

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: