Configuring Arp Detection; Introduction; Configuring Arp Detection Based On Specified Objects - H3C S5500-SI Series Operation Manual

Configuring ARP Detection

Introduction

The ARP detection feature is mainly configured on an access device to allow only the ARP packets of
authorized clients to be forwarded, hence preventing user spoofing and gateway spoofing.
ARP detection includes ARP detection based on specified objects, and ARP detection based on static
IP source guard binding entries/DHCP snooping entries/802.1X security entries/OUI MAC addresses.
If both the ARP detection based on specified objects and the ARP detection based on static IP Source
Guard binding entries/DHCP snooping entries/802.1X security entries/OUI MAC addresses are
enabled, the former one applies first, and then the latter applies.

Configuring ARP Detection Based on Specified Objects

With this feature configured, the device permits the ARP packets received from an ARP trusted port to
pass directly, and checks the ARP packets received from an ARP untrusted port. You can specify
objects in the ARP packets to be detected. The objects involve:
src-mac: Checks whether the sender MAC address of an ARP packet is identical to the source
MAC address in the Ethernet header. If they are identical, the packet is forwarded; otherwise, the
packet is discarded.
dst-mac: Checks the target MAC address of ARP replies. If the target MAC address is all-zero,
all-one, or inconsistent with the destination MAC address in the Ethernet header, the packet is
considered invalid and discarded.
ip: Checks both the source and destination IP addresses in an ARP packet. The all-zero, all-one or
multicast IP addresses are considered invalid and the corresponding packets are discarded. With
this object specified, the source and destination IP addresses of ARP replies, and the source IP
address of ARP requests are checked.
Follow these steps to configure ARP detection based on specified objects:
To do...
Enter system view
Enter VLAN view
Enable ARP detection for the
VLAN
Return to system view
Specify objects for ARP
detection
Enter Ethernet interface view
Use the command...
system-view
vlan vlan-id
arp detection enable
quit
arp detection validate
{ dst-mac | ip | src-mac } *
interface interface-type
interface-number
1-6
Remarks
—
—
Required
Disabled by default.
—
Required
Not specified by default.
—