Arp Restricted Forwarding Configuration Example - HP FlexFabric 5700 Series Security Configuration Manual

# Enable recording of client information in DHCP snooping entries on Ten-GigabitEthernet 1/0/1.
[SwitchB] interface ten-gigabitethernet 1/0/1
[SwitchB-Ten-GigabitEthernet1/0/1] dhcp snooping binding record
[SwitchB-Ten-GigabitEthernet1/0/1] quit
# Enable ARP detection for VLAN 10.
[SwitchB] vlan 10
[SwitchB-vlan10] arp detection enable
# Configure the upstream interface as a trusted interface. By default, an interface is an untrusted
interface.
[SwitchB-vlan10] interface ten-gigabitethernet 1/0/3
[SwitchB-Ten-GigabitEthernet1/0/3] arp detection trust
[SwitchB-Ten-GigabitEthernet1/0/3] quit
# Configure a static IP source guard binding on interface Ten-GigabitEthernet 1/0/2 for user
validity check.
[SwitchB] interface ten-gigabitethernet 1/0/2
[SwitchB-Ten-GigabitEthernet1/0/2] ip source binding ip-address 10.1.1.6 mac-address
0001-0203-0607 vlan 10
[SwitchB-Ten-GigabitEthernet1/0/2] quit
# Enable ARP packet validity check by checking the MAC addresses and IP addresses of ARP
packets.
[SwitchB] arp detection validate dst-mac ip src-mac
After the configurations are completed, Switch B first checks the validity of ARP packets received
on Ten-GigabitEthernet 1/0/1 and Ten-GigabitEthernet 1/0/2. If the ARP packets are confirmed
as valid, the switch performs user validity check by using the static IP source guard bindings and
finally DHCP snooping entries.

ARP restricted forwarding configuration example

Network requirements
As shown in
configured. Port isolation configured on Switch B can take effect for broadcast ARP requests.
Figure 1 14, configure ARP restricted forwarding on Switch B where ARP detection is
368