Entries/802.1X Security Entries/Oui Mac Addresses; Displaying And Maintaining Arp Detection - H3C S5500-SI Series Operation Manual

To do...
Enable ARP detection for
the VLAN
Return to system view
Enter Ethernet interface
view
Configure the port as a
trusted port on which ARP
detection does not apply
When configuring this feature, you need to configure ARP detection based on at least static IP
Source Guard binding entries, DHCP snooping entries, or 802.1X security entries. Otherwise, all
ARP packets received from an ARP untrusted port will be discarded, except the ARP packets with
an OUI MAC address as the sender MAC address when voice VLAN is enabled.
When configuring an IP Source Guard binding entry, you need to specify the VLAN; otherwise, no
ARP packet will pass the ARP detection based on static IP Source Guard binding entries.

Displaying and Maintaining ARP Detection

To do...
Display the VLANs enabled
with ARP detection
Display the ARP detection
statistics
Clear the ARP detection
statistics
ARP Detection Configuration Example I
Network requirements
As shown in Figure
Configure Host A as a DHCP client. Configure Host B whose IP address is 10.1.1.6 and MAC address
is 0001-0203-0607. Enable ARP detection for VLAN 10 to allow only packets from valid clients or hosts
to pass.
Use the command...
arp detection enable
quit
interface interface-type
interface-number
arp detection trust
Use the command...
display arp detection
display arp detection statistics [ interface
interface-type interface-number ]
reset arp detection statistics [ interface
interface-type interface-number ]
1-1, configure Switch A as a DHCP server and enable DHCP snooping on Switch B.
Required
Disabled by default. That is, ARP
detection based on static IP Source
Guard binding entries/DHCP snooping
entries/802.1X security entries/OUI MAC
addresses is not enabled by default.
—
—
Optional
The port is an untrusted port by default.
1-8
Remarks
Remarks
Available in any view
Available in any view
Available in user view