Configuring User Validity Check; Configuring Arp Packet Validity Check - HP FlexFabric 5930 Series Security Configuration Manual

Configuring user validity check

Upon receiving an ARP packet from an ARP untrusted interface, the device compares the sender IP and
MAC addresses against the static IP source guard binding entries and the DHCP snooping entries. If a
match is found from those entries, the ARP packet is considered valid and is forwarded. If no match is
found, the ARP packet is considered invalid and is discarded.
Static IP source guard binding entries are created by using the ip source binding command. For more
information, see
DHCP snooping entries are automatically generated by DHCP snooping. For more information, see
Layer 3—IP Services Configuration Guide.
Configuration guidelines
When you configure user validity check, follow these guidelines:
• Make sure at least one among static IP source guard binding entries and DHCP snooping entries is
available for user validity check. Otherwise, ARP packets received from ARP untrusted ports are
discarded.
You must specify a VLAN for an IP source guard binding entry. Otherwise, no ARP packets can
•
match the IP source guard binding entry.
Configuration procedure
To configure user validity check:
Step
1. Enter system view.
2. Enter VLAN view.
3. Enable ARP detection.
4. Return to system view.
5. Enter Layer 2 Ethernet interface
view or Layer 2 aggregate
interface view.
6. (Optional.) Configure the
interface as a trusted interface
excluded from ARP detection.

Configuring ARP packet validity check

Enable validity check for ARP packets received on untrusted ports and specify the following objects to be
checked:
src-mac—Checks whether the sender MAC address in the message body is identical to the source
•
MAC address in the Ethernet header. If they are identical, the packet is forwarded. Otherwise, the
packet is discarded.
dst-mac—Checks the target MAC address of ARP replies. If the target MAC address is all-zero,
•
all-one, or inconsistent with the destination MAC address in the Ethernet header, the packet is
considered invalid and discarded.
"Configuring IP source
Command
system-view
vlan vlan-id
arp detection enable
quit
interface interface-type
interface-number
arp detection trust
guard."
160
Remarks
N/A
N/A
By default, ARP detection is disabled.
N/A
N/A
By default, an interface is untrusted.