Denial of Service Protection Support
A Denial of Service (DoS) attack can occur against the ICX device when a high volume
of new source MAC addresses is sent to the device, causing the CPU to be overwhelmed
with performing RADIUS authentication for these MAC addresses. In addition, the high
CPU usage in such an attack could prevent the RADIUS response from reaching the CPU
in time, causing the device to make additional authentication attempts.
You can enable Denial of Service protection using the
authentication dos-protection command in interface configuration mode. The ICX device does not start forwarding
traffic from an authenticated MAC address in hardware until the RADIUS server authenticates
the MAC address. Traffic from the non-authenticated MAC addresses is sent to the CPU.