Configuring Arp Restricted Forwarding - HP A6600 Configuration Manual

NOTE:
Static IP source guard binding entries are created by using user-bind. For more information, see
•
Security Configuration Guide
Dynamic DHCP snooping entries are automatically generated through the DHCP snooping function.
•
For more information, see
802.1X security entries are generated in this case. For more information, see
•
Guide
.
To enable ARP detection for a VLAN and specify a trusted port:
To do...
1. Enter system view.
2. Enter VLAN view.
3. Enable ARP detection for the
VLAN.
4. Return to system view.
5. Enter Ethernet interface view.
6. Configure the port as a
trusted port on which ARP
detection does not apply.
NOTE:
When configuring this feature, you must configure ARP detection based on at least static IP source
•
guard binding entries, DHCP snooping entries, or 802.1X security entries. Otherwise, all ARP packets
received from an ARP untrusted port are discarded except the ARP packets with an OUI MAC
address as the sender MAC address when voice VLAN is enabled.
When configuring an IP source guard binding entry, you must specify the VLAN. Otherwise, no ARP
•
packet passes the ARP detection based on static IP source guard binding entries.

Configuring ARP restricted forwarding

ARP restricted forwarding controls the forwarding of ARP packets that are received on untrusted ports
and have passed ARP detection in the following cases:
If the packets are ARP requests, they are forwarded through the trusted ports.
•
If the packets are ARP responses, they are forwarded according to their destination MAC address.
•
If no match is found in the MAC address table, they are forwarded through the trusted ports.
Before performing the following configuration, make sure you have configured the arp detection enable.
To enable ARP restricted forwarding:
To do...
1. Enter system view.
.
Layer 3—IP Services Configuration Guide
Command...
system-view
vlan vlan-id
arp detection enable
quit
interface interface-type
interface-number
arp detection trust
Command...
system-view
425
.
Security Configuration
Remarks
—
—
Required.
ARP detection based on static IP Source
Guard binding entries/DHCP snooping
entries/802.1X security entries/OUI MAC
addresses is disabled by default.
—
—
Optional.
The port is an untrusted port by default.
Remarks
—