3-6
Virus Throttling (Connection-Rate Filtering)
Overview of Connection-Rate Filtering
Operating Rules
■ Connection-rate filtering does not operate on IPv6 traffic.
■ Connection-rate filtering is triggered by inbound IP traffic exhibiting
high rates of IP connections to new hosts. After connection-rate
filtering has been triggered on a port, all traffic from the suspect host
is subject to the configured connection-rate policy (notify-only, throttle,
or block).
■ When connection-rate filtering is configured on a port, the port cannot
be added to, or removed from, a port trunk group. Before this can be
done, connection-rate filtering must be disabled on the port.
■ Where the switch is throttling or blocking inbound IP traffic from a
host, any outbound traffic destined for that host is still permitted.
■ Once a throttle has been triggered on a port—temporarily blocking
inbound IP traffic—it cannot be undone during operation: the penalty
period must expire before traffic will be allowed from the host.
Unblocking a Currently Blocked Host
A host blocked by connection-rate filtering remains blocked until explicitly
unblocked by one of the following methods:
■ Using the connection-rate-filter unblock command (page 3-15).
■ Rebooting the switch.
■ Disabling connection-rate filtering using the no connection-rate-filter
command.
■ Deleting a VLAN removes blocks on any hosts on that VLAN.
Note Changing a port setting from block to throttle, notify-only, or to no filter connec-
tion-rate, does not unblock a currently blocked host. Similarly, applying a
connection-rate ACL will not unblock a currently blocked host. Refer to the
above list for the correct methods to use to unblock a host.
To Next Page
Loading...
Need help?
General