Cisco Systems 4500 PPPoE Intermediate Agent, Storm Control, uRPF Strict Mode

1-29
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 1 Product Overview Security Features
PPPoE Intermediate Agent
PPPoE Intermediate Agent (PPPoE IA) is placed between a subscriber and BRAS to help the service
provider BRAS distinguish between end hosts connected over Ethernet to an access switch. On the
access switch, PPPoE IA enables Subscriber Line Identification by appropriately tagging Ethernet
frames of different users. (The tag contains specific information such as which subscriber is connected
to the switch and VLAN.) PPPoE IA acts as mini-security firewall between host and BRAS by
intercepting all PPPoE Active Discovery (PAD) messages on a per-port per-VLAN basis. It provides
specific security feature such as verifying the intercepted PAD message from untrusted port, performing
per-port PAD message rate limiting, inserting and removing VSA tags into and from PAD messages,
respectively.
For information on PPPoE IA, see Chapter 41, “Configuring the PPPoE Intermediate Agent.”
Storm Control
Broadcast suppression is used to prevent LANs from being disrupted by a broadcast storm on one or
more switch ports. A LAN broadcast storm occurs when broadcast packets flood the LAN, creating
excessive traffic and degrading network performance. Errors in the protocol-stack implementation or in
the network configuration can cause a broadcast storm. Multicast and broadcast suppression measures
how much broadcast traffic is passing through a port and compares the broadcast traffic with some
configurable threshold value within a specific time interval. If the amount of broadcast traffic reaches
the threshold during this interval, broadcast frames are dropped, and optionally the port is shut down.
Cisco IOS Software Release 12.2(40)SG allows suppression of broadcast and multicast traffic on a
per-port basis. (Supervisor Engine 6-E and Supervisor Engine 6L-E only)
For information on configuring broadcast suppression, see Chapter 50, “Configuring Storm Control.”
uRPF Strict Mode
Note The feature is only supported on Supervisor Engine 6-E, Supervisor 6L-E, Catalyst 4900M, and Catalyst
4948E.
The uRPF feature mitigates problems caused by the introduction of malformed or forged (spoofed) IP
source addresses into a network by discarding IP packets that lack a verifiable IP source address. uRPF
deflects denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks by forwarding only
packets that have source addresses that are valid and consistent with the IP routing table. This helps to
protect the network of the customer, the ISP, and the rest of the Internet. When using uRPF in strict mode,
the packet must be received on the interface that the router uses to forward the return packet. uRPF strict
mode is supported for both IPv4 and IPv6 prefixes.
For information on configuring broadcast suppression, see Chapter 32, “Configuring Unicast Reverse
Path Forwarding.”