Fabric resiliency: ARP cache protection to prevent DOS attacks

You can configure an ARP cache limit for resolved and unresolved next-hop entries in the cache. This limits the maximum number of next hops that can be created. The benefit of configuring ARP cache limit is to protect the device from DOS attacks. You can configure the cache limit globally at the system level or for a particular interface. To configure the cache limit at the system level, include the arp-system-cache-limit statement at the [edit system] hierarchy level. To configure the cache limit at an interface level, include the arp-max-cache statement at the [edit interfaces interface-name unit interface-unit-number family inet] hierarchy level. To configure the maximum number of unresolved next-hop entries to hold for an interface, set the arp-new-hold-limit statement at the [edit interfaces interface-name unit interface-unit-number family inet] hierarchy level. To view ARP cache statistics at the system level, run the show system statistics arp command. To view the ARP cache statistics for an interface, run the show interfaces interface-name command.