xStack® DES-3200 Series Layer 2 Managed Fast Ethernet Switch
222
Click the Edit button to re-configure the specific entry.
Click the Delete button to remove an entry.
Click the Delete All button to remove all the entries listed.
Safeguard Engine Settings
Periodically, malicious hosts on the network will attack the Switch by utilizing packet flooding (ARP Storm) or other
methods. These attacks may increase the switch load beyond its capability. To alleviate this problem, the
Safeguard Engine function was added to the Switch’s software.
The Safeguard Engine can help the overall operability of the Switch by minimizing the workload of the Switch while
the attack is ongoing, thus making it capable to forward essential packets over its network in a limited bandwidth.
The Safeguard Engine has two operating modes that can be configured by the user, Strict and Fuzzy. In the Strict
mode, when the CPU utilization of the Switch is over the Rising Threshold, it will enter the Exhausted mode. When
in this mode, the Switch will stop all IP broadcast packets, packets from un-trusted IP address, and mostly ARP
request packets to the Switch for a calculated time interval. Every five seconds, the Safeguard Engine checks the
CPU utilization of the Switch. If the threshold has been crossed, the Switch will initially enter the Exhausted mode
for five seconds. After another five-second checking interval arrives, the Switch will again check the CPU utilization.
If the CPU utilization is lower than Falling Threshold, the Switch will again begin accepting all packets. Yet, if the
checking shows that the Switch is too busy, it will fall into the Exhausted mode for double the time of the previous
stop period. This doubling of time for stopping these packets will continue until the maximum time has been
reached, which is 320 seconds and every stop from this point until a return to normal ingress flow would be 320
seconds. For a better understanding, please examine the following example of the Safeguard Engine.
Figure 8-64 Mapping QoS on the Switch
For every consecutive checking interval that reveals the high CPU utilization issue, the Switch will double the time
to enter the Exhausted mode to limit the specified traffic to the Switch. In the example above, the Switch doubled
the time in the Exhausted mode when consecutive high CPU utilization issues were detected at 5-second intervals.
(First stop = 5 seconds, second stop = 10 seconds, third stop = 20 seconds) Once the CPU utilization is below the
Falling Threshold, the wait period for the Exhausted mode will return to 5 seconds and the process will resume.
In Fuzzy mode, once the Safeguard Engine has entered the Exhausted mode, the Safeguard Engine will decrease
the packet flow to the Switch by half. After returning to Normal mode, the packet flow will be increased by 25%. The
switch will then return to its interval checking and dynamically adjust the packet flow to avoid overload of the Switch.
Users can enable the Safeguard Engine or configure advanced Safeguard Engine settings for the Switch.
To view this window, click Security > Safeguard Engine Settings as shown below:
To Next Page
Loading...
Need help?
General
