• List of settings
• Examples
  • D-Link DGS-3120
  • D-Link DES-1210-28ME
  • Huawei S2326TP-EI

Basic protection from packet storm and "piggy" clients in LAN. Solves 95% of problems caused by missconfigured/missfunctioning client software/hardware, simple hacker attacks and troyans. Is recommended for DHCP-based networks

List of necessary settings

• STP BPDU filter
• loop-detect on client ports
• broadcast/multicast bandwith limit (storm control)
• limit MAC learning on client ports
• deny DHCP replies from clients (UDP src port 67)
• deny DHCPv6 replies from clients (UDP src port 547)
• use DHCP option 82 if possible
• deny some types of multicast traffic, thise often cause storms:
  224.0.0.251, 224.0.0.252, 224.0.0.253, 239.192.152.143, 239.255.255.250
• Microsoft protocols (smb):
  TCP/UDP 135,137-139,445
• UNPnP UDP 1900, 2869, 5000
• deny "suspicious" MACs (00:00:00:00:00:00)
• deny unused ethernet frame type(s). For example
  0x8863 (PPoE discovery), 0x8137 (IPX)

Examples

D-Link DGS-3120

config stp ports $client_ports fbpdu disable
config stp ports $client_ports state disable

enable loopdetect
config loopdetect ports $client_ports state enable

config traffic control $client_ports threshold 3500 multicast enable 
config traffic control $client_ports threshold 3500 broadcast enable 

create access_profile profile_id 1 profile_name bad_mac ethernet source_mac ff:ff:ff:ff:ff:ff
config access_profile profile_id 1 add access_id 1 ethernet source_mac 00:00:00:00:00:00 ports 1-24 deny

create access_profile profile_id 2 profile_name bad_proto ethernet vlan ethernet_type
config access_profile profile_id 2 add access_id 3 ethernet ethernet_type 0x8863  port 1-24 deny
config access_profile profile_id 2 add access_id 5 ethernet ethernet_type 0x8137  port 1-24 deny

create access_profile profile_id 3 profile_name bad_mcast ip destination_ip_mask 255.255.255.255 udp
config access_profile profile_id 3 add access_id 2 ip destination_ip 224.0.0.252 udp  port 1-24 deny
config access_profile profile_id 3 add access_id 3 ip destination_ip 224.0.0.251 udp  port 1-24 deny
config access_profile profile_id 3 add access_id 4 ip destination_ip 239.192.152.143 udp  port 1-24 deny
config access_profile profile_id 3 add access_id 5 ip destination_ip 239.255.255.250 udp  port 1-24 deny
config access_profile profile_id 3 add access_id 6 ip destination_ip 224.0.0.252 udp  port 1-24 deny
config access_profile profile_id 3 add access_id 7 ip destination_ip 224.0.0.253 udp  port 1-24 deny

create access_profile profile_id 4 profile_name win_tcp ip tcp dst_port_mask 0xFFFF 
config access_profile profile_id 4 add access_id 1 ip tcp dst_port 445 port 1-24 deny
config access_profile profile_id 4 add access_id 4 ip tcp dst_port 135 port 1-24 deny
config access_profile profile_id 4 add access_id 6 ip tcp dst_port 137 port 1-24 deny
config access_profile profile_id 4 add access_id 7 ip tcp dst_port 138 port 1-24 deny
config access_profile profile_id 4 add access_id 8 ip tcp dst_port 139 port 1-24 deny

create access_profile profile_id 5 profile_name win_udp ip udp dst_port_mask 0xFFFF
config access_profile profile_id 5 add access_id 1 ip udp dst_port 137 port 1-24 deny
config access_profile profile_id 5 add access_id 2 ip udp dst_port 138 port 1-24 deny
config access_profile profile_id 5 add access_id 4 ip udp dst_port 135 port 1-24 deny
config access_profile profile_id 5 add access_id 5 ip udp dst_port 445 port 1-24 deny
config access_profile profile_id 5 add access_id 10 ip tcp dst_port 1900 port 1-24 deny
config access_profile profile_id 5 add access_id 11 ip udp dst_port 5000 port 1-24 deny
config access_profile profile_id 5 add access_id 12 ip udp dst_port 2869 port 1-24 deny

create access_profile profile_id 6 profile_name bad_dhcp ip udp src_port_mask 0xFFFF
config access_profile profile_id 6 add access_id 1 ip udp src_port 67 port $client_ports deny

D-Link DES-1210-28ME

config stp ports $client_ports fbpdu disable
config stp ports $client_ports state disable

config loopdetect enable
config loopdetect ports $client_ports

config traffic control $client_ports broadcast enable multicast enable threshold 64

create access_profile profile_id 2 ethernet ethernet_type
config access_profile profile_id 2 add access_id 3 ethernet ethernet_type 0x8863  port 1-28 deny
config access_profile profile_id 2 add access_id 5 ethernet ethernet_type 0x8137  port 1-28 deny

create access_profile profile_id 4 ip tcp dst_port_msk 0xFFFF
config access_profile profile_id 4 add access_id 41 ip tcp dst_port 445  ports 1-28 deny
config access_profile profile_id 4 add access_id 44 ip tcp dst_port 135  ports 1-28 deny
config access_profile profile_id 4 add access_id 46 ip tcp dst_port 137  ports 1-28 deny
config access_profile profile_id 4 add access_id 47 ip tcp dst_port 138  ports 1-28 deny
config access_profile profile_id 4 add access_id 48 ip tcp dst_port 139  ports 1-28 deny

create access_profile profile_id 5 ip udp dst_port_msk 0xFFFF
config access_profile profile_id 5 add access_id 51 ip udp dst_port 137  ports 1-28 deny
config access_profile profile_id 5 add access_id 52 ip udp dst_port 138  ports 1-28 deny
config access_profile profile_id 5 add access_id 54 ip udp dst_port 135  ports 1-28 deny
config access_profile profile_id 5 add access_id 55 ip udp dst_port 445  ports 1-28 deny
config access_profile profile_id 5 add access_id 56 ip udp dst_port 1900 ports 1-28 deny
config access_profile profile_id 5 add access_id 57 ip udp dst_port 5000 ports 1-28 deny
config access_profile profile_id 5 add access_id 58 ip udp dst_port 2869 ports 1-28 deny

create access_profile profile_id 6 ip udp src_port_mask 0xFFFF
config access_profile profile_id 6 add access_id 61 ip udp src_port 67  ports $client_ports deny

create access_profile profile_id 7 ipv6 udp src_port_mask 0xFFFF
config access_profile profile_id 7 add access_id 62 ipv6 udp src_port 547  ports $client_ports deny

Huawei S2326TP-EI

bpdu disable
stp disable

acl 4000
rule 11 deny source-mac 0000-0000-0000
rule 23 deny l2-protocol 0x8863
rule 24 deny l2-protocol 0x8137
quit

acl 3000
rule 41 deny udp destination-port eq 445
rule 42 deny udp destination-port range 137 139
rule 43 deny udp destination-port eq 135
rule 51 deny tcp destination-port eq 445
rule 52 deny tcp destination-port range 137 139
rule 61 deny udp source-port eq 67
quit

traffic classifier win-ports operator or
if-match acl 3000
if-match acl 4000
traffic behavior win-ports
deny
traffic policy win-ports
classifier win-ports behavior win-ports
quit

traffic classifier bad-proto operator and
if-match acl 4000
traffic behavior bad-proto
deny
traffic policy bad-proto
classifier bad-proto behavior bad-proto
quit

port-group Clients
mac-limit maximum 3
port-security max-mac-num 3
broadcast-suppression 1
multicast-suppression 1
loopback-detect enable
traffic-policy win-ports inbound
quit

port-group Uplinks
traffic-policy bad-proto inbound
quit

FB