A number of security features are integrated into the DGS-6650 Series to help protect other core devices and networks. Built into the DGS-6650 switches is CPU Protection Policy (CPP) technology which automatically differentiates the traffic of multi-layer protocol IPv4/IPv6 packets destined for the CPU and limits the traffic speed to prevent abnormal packets from attacking the CPU and consuming unnecessary resources. This helps to ensure the stability of CPUs for other core devices and the DGS-6650 Series in the IPv4/IPv6 L3 network and L2 network environments and keeps the network running in an optimal state.

Other security measures include hardware-based IPv6 ACL allows IPv4/IPv6 users to coexist and control the resources access by users. The DGS-6650 Series also implements flexible binding of a port or the system to the IP address and MAC address of a user, strictly limiting user access on a port or in the entire system. There is also support for DHCP snooping, which allows DHCP responses from trusted ports only. By using DHCP listening and by monitoring ARP dynamically and checking the user IP address, the DGS-6650 Series switches discard illegal packets inconsistent with binding entries to effectively prevents ARP and source IP address spoofing.

The DGS-6650 supports spanning tree protocols (STP) 802.1D, 802.1w, as well as 802.1s to ensure rapid convergence, improve fault tolerance capabilities, ensure stable operation of networks, and provide redundant networking pathways. Virtual Router Redundant Protocol (VRRP) and Rapid Link Detection Protocol (RLDP) effectively ensure network stability. RLDP detects the connectivity of links and whether an optical fiber link is normal from both ends and supports the loop detection function based on the port to prevent network faults caused by loopbacks originating from the connection of devices such as hubs to ports.

The DGS-6650 Series also supports Rapid Ethernet Ring Protection Protocol (RERP), a Layer 2 redundancy protocol designed for the core Ethernet network. When loop blocking and link recovery are performed on a master device, the DGS-6650 Series switches will report its link status to the master device without needing to be processed by other non-master devices. This allows the loop blocking time and link recovery to be shorter compared to when STP is used. When STP is disabled, the Rapid Ethernet Uplink Protection Protocol (REUP) can also provide basic link redundancy through a rapid uplink protection function and help to provide faster subsecond-level fault recovery than STP would be able to.