H3C S5120-SI Series Configuration Manual page 26

Figure 5 Network diagram for ARP detection configuration
DHCP snooping
Switch A
GE1/0/1
Host A
DHCP client
Configuration procedure
•
Add all the ports on Switch A to VLAN 10 (the configuration procedure is not shown).
•
Configure DHCP server (the configuration procedure is not shown).
•
Configure Host A as DHCP client, and Host B as user respectively (the configuration procedure is not
shown)
Configure Switch A
1.
Enable DHCP snooping.
<SwitchA> system-view
[SwitchA] dhcp-snooping
[SwitchA] interface GigabitEthernet 1/0/3
[SwitchA-GigabitEthernet1/0/3] dhcp-snooping trust
[SwitchA-GigabitEthernet1/0/3] quit
Enable ARP detection for VLAN 10.
[SwitchA] vlan 10
[SwitchA-vlan10] arp detection enable
Configure the upstream port as a trusted port and the downstream ports as untrusted ports (a port is an
untrusted port by default).
[SwitchA-vlan10] interface GigabitEthernet 1/0/3
[SwitchA-GigabitEthernet1/0/3] arp detection trust
[SwitchA-GigabitEthernet1/0/3] quit
Configure a static IP-to-MAC binding.
[SwitchA] arp detection static-bind 10.1.1.1 000f-e249-8050
Enable ARP detection based on both DHCP snooping entries and static IP-to-MAC bindings.
[SwitchA] arp detection mode dhcp-snooping
[SwitchA] arp detection mode static-bind
Enable the checking of the MAC addresses and IP addresses of ARP packets.
Gateway
DHCP server
VLAN 10
GE1/0/3
GE1/0/2
Host B
10.1.1.6
0001-0203-0607
26