Configuring User Validity Check - HP MSR Series Configuration Manual

MSR954(JH296A/JH297A/JH299A).
MSR1002-4/1003-8S.
MSR2004-24/2004-48.
ARP detection enables access devices to block ARP packets from unauthorized clients to prevent
user spoofing and gateway spoofing attacks. ARP detection does not check ARP packets received
from ARP trusted interfaces.
ARP detection provides the user validity check, ARP packet validity check, and ARP restricted
forwarding features.
If both ARP packet validity check and user validity check are enabled, the former one applies first,
and then the latter applies.

Configuring user validity check

Upon receiving an ARP packet from an ARP untrusted interface, the device matches the sender IP
and MAC addresses with the following entries:
•
Static IP source guard binding entries
•
DHCP snooping entries
If a match is found, the ARP packet is considered valid and is forwarded. If no match is found, the
ARP packet is considered invalid and is discarded.
Static IP source guard binding entries are created by using the ip source binding command. For
more information, see
DHCP snooping entries are automatically generated by DHCP snooping. For more information, see
Layer 3—IP Services Configuration Guide.
Configuration guidelines
When you configure user validity check, follow these guidelines:
•
Make sure one or more of the following items is configured for user validity check:
Static IP source guard bindings.
DHCP snooping.
If none of the items is configured, all incoming ARP packets on ARP untrusted interfaces are
discarded.
•
You must specify a VLAN for an IP source guard binding entry. Otherwise, no ARP packets can
match the IP source guard binding entry.
Configuration procedure
To configure user validity check:
Step
1. Enter system view.
2. Enter VLAN view.
3. Enable ARP detection.
4. Return to system view.
5. Enter Layer 2 Ethernet
interface view or Layer 2
aggregate interface view.
6. (Optional.) Configure the
interface as a trusted interface
"Configuring IP source
Command
system-view
vlan vlan-id
arp detection enable
quit
interface interface-type
interface-number
arp detection trust
533
guard."
Remarks
N/A
N/A
By default, ARP detection is
disabled.
N/A
N/A
By default, an interface is untrusted.