MA5608T – Hardening how to harden our GPON configuration in a way that flooding (multicast, broadcast, icmp, dhcp etc.) from GPON to Network/Backbone could not happen

Issue Description

MA5608T – Hardening how to harden our GPON configuration in a way that flooding (multicast, broadcast, icmp, dhcp etc.) from GPON to Network/Backbone could not happen
Customer had the issue that IPv6 DHCP requests from one of their customers flooded their network. Customer is connected with a ONT Huawei EG8245H (configured as bridge) to an OLT MA-5608T by using PPPoE as Data transport.
how to harden our GPON configuration in a way that flooding (multicast, broadcast, icmp, dhcp etc.) from GPON Customers to our Network/Backbone could not happen? Some kind of “ANTI DoS” Rules. Best practice configuration templates or ACL examples?
Our Customer traffic is in VLAN 60 and on interface gpon port 0/0/0
We’ve made this configuration:
display acl all
Total nonempty acl number is 1
Link ACL  4000, 3 rules
Acl’s step is 5
rule 3 permit type 0x8863 source 60
rule 2 permit type 0x8864 source 60
rule 1 deny
display acl ipv6 all
Total nonempty acl6 number is 1
Basic IPv6 ACL 2000, 1 rule
packet-filter inbound link-group 4000 port 0/0/0
packet-filter outbound link-group 4000 port 0/0/0
packet-filter inbound ipv6 ip-group 2000 port 0/0/0
packet-filter outbound ipv6 ip-group 2000 port 0/0/0

Handling Process

PRODUCT : MA5608T
VERSION : MA5600V800R015C10
If customer want to  permit  PPPOE packets though  port  0/0/0,  we had test  it, it’s  ok  for packet-filter  PPPOE packets and  deny other packets.
if apply  acl  4000 and  acl  2000  at  the  same  time. It will  hit  acl 4000 firstly.  So  the packet of  ipv6 will  drooped.

Solution

The packet’s  though  is  based  on ipv4 but your  configuration  ids  based  on  ipv6. So  the packet  cannot  hit  the  acl  rules, if  you want  to  deny  IPv4  packets just use :

huawei(config-acl-basic-2000)#rule  1  deny

Please note that, the outbound parameter takes effect only on the known unicast packets. Therefore, some packets does not deny, maybe these packets are broadcast/multicast/unknown unicast packets on the outbound direction.
OUTBOUND
Indicates the outbound direction of a port. The direction is from the network side to the user access side in the case of user port or cascade port; the direction is from the user access side to the network side in the case of network port.
The outbound parameter takes effect only on the known unicast .

If only permit PPPoE packets pass, you can just configure the following configuration is enough.
packet-filter inbound link-group 4000 rule 1 port 0/0/0
packet-filter inbound link-group 4000 rule 2 port 0/0/0
packet-filter inbound link-group 4000 rule 3 port 0/0/0
packet-filter outbound link-group 4000 rule 1 port 0/0/0
packet-filter outbound link-group 4000 rule 2 port 0/0/0
packet-filter outbound link-group 4000 rule 3 port 0/0/0