Configuring Arp Packet Validity Check - HP 6125G Configuration Manual

At least the configured rules, static IP source guard binding entries, DHCP snooping entries, or
•
802.1X security entries must be available for user validity check. Otherwise, ARP packets received
from ARP untrusted ports will be discarded, except the ARP packets with an OUI MAC address as
the sender MAC address when voice VLAN is enabled.
• You must specify a VLAN for an IP source guard binding entry. Otherwise, no ARP packets can
match the IP source guard binding entry.
Configuration procedure
To configure user validity check:
Step
1. Enter system view.
2. Set rules for user validity
check.
3. Enter VLAN view.
4. Enable ARP detection for the
VLAN.
5. Return to system view.
6. Enter Layer 2 Ethernet
interface/Layer 2 aggregate
interface view.
7. Configure the port as a
trusted port on which ARP
detection does not apply.

Configuring ARP packet validity check

Perform this task to enable validity check for ARP packets received on untrusted ports and specify the
following objects to be checked.
• src-mac—Checks whether the sender MAC address in the message body is identical to the source
MAC address in the Ethernet header. If they are identical, the packet is forwarded. Otherwise, the
packet is discarded.
dst-mac—Checks the target MAC address of ARP replies. If the target MAC address is all-zero,
•
all-one, or inconsistent with the destination MAC address in the Ethernet header, the packet is
considered invalid and discarded.
ip—Checks the sender and target IP addresses of ARP replies, and the sender IP address of ARP
•
requests. All-zero, all-one, or multicast IP addresses are considered invalid and the corresponding
packets are discarded.
To configure ARP packet validity check:
Command
system-view
arp detection id-number { permit |
deny } ip { any | ip-address
[ ip-address-mask ] } mac { any |
mac-address [ mac-address-mask ] }
[ vlan vlan-id ]
vlan vlan-id
arp detection enable
quit
interface interface-type
interface-number
arp detection trust
242
Remarks
N/A
Optional.
By default, no rule is configured.
N/A
ARP detection based on static IP
source guard binding
entries/DHCP snooping
entries/802.1X security
entries/OUI MAC addresses is
disabled by default.
N/A
N/A
Optional.
The port is an untrusted port by
default.