Cisco Sg3008 Manual

Security
Configuring Port Security
354 Cisco Small Business 200, 300 and 500 Series Managed Switch Administration Guide (Internal Version) 
18
•Storm Control Mode—Select one of the modes: 
-Unknown Unicast, Multicast & Broadcast—Counts unknown Unicast, 
Broadcast, and Multicast traffic towards the bandwidth threshold.
-Multicast & Broadcast—Counts Broadcast and Multicast traffic towards 
the bandwidth threshold.
-Broadcast Only—Counts only Broadcast traffic towards the bandwidth 
threshold.
STEP  4Click...

Security
Configuring Port Security
Cisco Small Business 200, 300 and 500 Series Managed Switch Administration Guide (Internal Version)  355
18
 
When a frame from a new MAC address is detected on a port where it is not 
authorized (the port is classically locked, and there is a new MAC address, or the 
port is dynamically locked, and the maximum number of allowed addresses has 
been exceeded), the protection mechanism is invoked, and one of the following 
actions can take place:
•Frame is discarded...

Security
802.1X
356 Cisco Small Business 200, 300 and 500 Series Managed Switch Administration Guide (Internal Version) 
18
-Secure Permanent—Keeps the current dynamic MAC addresses 
associated with the port and learns up to the maximum number of 
addresses allowed on the port (set by Max No. of Addresses Allowed). 
Relearning and aging are enabled. 
-Secure Delete on Reset—Deletes the current dynamic MAC addresses 
associated with the port after reset. New MAC addresses can be learned 
as...

Security
Denial of Service Prevention
Cisco Small Business 200, 300 and 500 Series Managed Switch Administration Guide (Internal Version)  357
18
 
Denial of Service Prevention 
A Denial of Service (DoS) attack is a hacker attempt to make a device unavailable 
to its users. 
DoS attacks saturate the device with external communication requests, so that it 
cannot respond to legitimate traffic. These attacks usually lead to a device CPU 
overload.
Secure Core Technology (SCT ) 
One method of resisting DoS...

Security
Denial of Service Prevention
358 Cisco Small Business 200, 300 and 500 Series Managed Switch Administration Guide (Internal Version) 
18
•Martian Addresses—Martian addresses are illegal from the point of view of 
the IP protocol. See Martian Addresses for more details.
•ICMP Attack—Sending malformed ICMP packets or overwhelming number 
of ICMP packets to the victim that might lead to a system crash. 
•IP Fragmentation—Mangled IP fragments with overlapping, over-sized 
payloads are sent to the...

Security
Denial of Service Prevention
Cisco Small Business 200, 300 and 500 Series Managed Switch Administration Guide (Internal Version)  359
18
 
•Prevent TCP connections from a specific interface (SYN Filtering page) and 
rate limit the packets (SYN Rate Protection page)
•Configure the blocking of certain ICMP packets (ICMP Filtering page)
•Discard fragmented IP packets from a specific interface (IP Fragments 
Filtering page)
•Deny attacks from Stacheldraht Distribution, Invasor Trojan, and Back...

Security
Denial of Service Prevention
360 Cisco Small Business 200, 300 and 500 Series Managed Switch Administration Guide (Internal Version) 
18
STEP 1Click Security > Denial of Service Prevention > Security Suite Settings. The 
Security Suite Settings displays.
CPU Protection Mechanism: Enabled indicates that SCT is enabled. 
STEP  2Click Details beside CPU Utilization to go to the CPU Utilization page and view 
CPU resource utilization information.
STEP  3Click Edit beside TCP SYN Protection to go to...

Security
Denial of Service Prevention
Cisco Small Business 200, 300 and 500 Series Managed Switch Administration Guide (Internal Version)  361
18
 
SYN Protection
The network ports might be used by hackers to attack the device in a SYN attack, 
which consumes TCP resources (buffers) and CPU power. 
Since the CPU is protected using SCT, TCP traffic to the CPU is limited. However, if 
one or more ports are attacked with a high rate of SYN packets, the CPU receives 
only the attacker packets, thus creating...

Security
Denial of Service Prevention
362 Cisco Small Business 200, 300 and 500 Series Managed Switch Administration Guide (Internal Version) 
18
•Current Status—Interface status. The possible values are:
-Normal—No attack was identified on this interface.
-Blocked—Traffic is not forwarded on this interface.
-Attacked—Attack was identified on this interface.
•Last Attack—Date of last SYN-FIN attack identified by the system and the 
system action (Reported or Blocked and Reported).
Martian Addresses
The...

Security
Denial of Service Prevention
Cisco Small Business 200, 300 and 500 Series Managed Switch Administration Guide (Internal Version)  363
18
 
STEP  3To add a Martian address click Add.
STEP  4Enter the parameters.
•IP Version—Indicates the supported IP version. Currently, support is only 
of fere d for IP v4.
•IP Address—Enter an IP addresses to reject. The possible values are:
-
From Reserved List—Select a well-known IP address from the reserved 
list.
-
New IP Address—Enter an IP address....