Configuring Arp Restricted Forwarding - HP 3600 v2 Series Configuration Manual

src-mac—Checks whether the sender MAC address in the message body is identical to the source
•
MAC address in the Ethernet header. If they are identical, the packet is forwarded. Otherwise, the
packet is discarded.
• dst-mac—Checks the target MAC address of ARP replies. If the target MAC address is all-zero,
all-one, or inconsistent with the destination MAC address in the Ethernet header, the packet is
considered invalid and discarded.
ip—Checks the sender and target IP addresses of ARP replies, and the sender IP address of ARP
•
requests. All-zero, all-one, or multicast IP addresses are considered invalid and the corresponding
packets are discarded.
To configure ARP packet validity check:
Step
1. Enter system view.
2. Enter VLAN view.
3. Enable ARP detection for the
VLAN.
4. Return to system view.
5. Enable ARP packet validity
check and specify the objects to
be checked.
6. Enter Layer 2 Ethernet
port/Layer 2 aggregate
interface view.
7. Configure the port as a trusted
port on which ARP detection
does not apply.

Configuring ARP restricted forwarding

ARP restricted forwarding controls the forwarding of ARP packets that are received on untrusted ports
and have passed ARP detection in the following cases:
If the packets are ARP requests, they are forwarded through the trusted ports.
•
If the packets are ARP responses, they are forwarded according to their destination MAC address.
•
If no match is found in the MAC address table, they are forwarded through the trusted ports.
Before performing the following configuration, make sure you have configured the arp detection enable
command.
To enable ARP restricted forwarding:
Step
1. Enter system view.
2. Enter VLAN view.
3. Enable ARP restricted forwarding.
Command
system-view
vlan vlan-id
arp detection enable
quit
arp detection validate { dst-mac | ip |
src-mac } *
interface interface-type
interface-number
arp detection trust
Command
system-view
vlan vlan-id
arp restricted-forwarding enable
382
Remarks
N/A
N/A
Disabled by default.
N/A
Disabled by default.
N/A
Optional.
The port is an untrusted port
by default.
Remarks
N/A
N/A
Disabled by default