Configuration Example; Configuring Arp Filtering - HP FlexFabric 5700 Series Security Configuration Manual

Step
3. Enable ARP gateway protection
for the specified gateway.

Configuration example

Network requirements
As shown in
Switch B intends to send to Switch A is sent to Host B.
Configure Switch B to block such attacks.
Figure 115 Network diagram
Configuration procedure
# Configure ARP gateway protection on Switch B.
<SwitchB> system-view
[SwitchB] interface ten-gigabitethernet 1/0/1
[SwitchB-Ten-GigabitEthernet1/0/1] arp filter source 10.1.1.1
[SwitchB-Ten-GigabitEthernet1/0/1] quit
[SwitchB] interface ten-gigabitethernet 1/0/2
[SwitchB-Ten-GigabitEthernet1/0/2] arp filter source 10.1.1.1
Verifying the configuration
# Verify that Ten-GigabitEthernet 1/0/1 and Ten-GigabitEthernet 1/0/2 discard the incoming ARP
packets whose sender IP address is the IP address of the gateway.

Configuring ARP filtering

The ARP filtering feature can prevent gateway spoofing and user spoofing attacks.
Figure 1 15, Host B launches gateway spoofing attacks to Switch B. As a result, traffic that
Command
arp filter source ip-address
372
Remarks
By default, ARP gateway
protection is disabled.