HP A6600 Configuration Manual page 439

Configuration procedure
Add all the ports on Router B to VLAN 10, and configure the IP address of VLAN-interface 10 on
1.
Router A. (Omitted)
Configure Router A as a DHCP server.
2.
# Configure DHCP address pool 0.
<RouterA> system-view
[RouterA] dhcp enable
[RouterA] dhcp server ip-pool 0
[RouterA-dhcp-pool-0] network 10.1.1.0 mask 255.255.255.0
Configure Host A as DHCP client, and Host B as user. (Omitted)
3.
Configure Router B.
4.
# Enable DHCP snooping.
<RouterB> system-view
[RouterB] dhcp-snooping
[RouterB] interface gigabitethernet1/0/3
[RouterB-GigabitEthernet1/0/3] dhcp-snooping trust
[RouterB-GigabitEthernet1/0/3] quit
# Enable ARP detection for VLAN 10.
[RouterB] vlan 10
[RouterB-vlan10] arp detection enable
# Configure the upstream port as a trusted port and the downstream ports as untrusted ports (a port is an
untrusted port by default).
[RouterB-vlan10] interface gigabitethernet1/0/3
[RouterB-GigabitEthernet1/0/3] arp detection trust
[RouterB-GigabitEthernet1/0/3] quit
# Configure a static IP source guard binding entry on interface GigabitEthernet1/0/2.
[RouterB] interface gigabitethernet1/0/2
[RouterB-GigabitEthernet1/0/2] user-bind ip-address 10.1.1.6 mac-address 0001-0203-0607
vlan 10
[RouterB-GigabitEthernet1/0/2] quit
# Enable the checking of the MAC addresses and IP addresses of ARP packets.
[RouterB] arp detection validate dst-mac ip src-mac
After the preceding configurations are complete, when ARP packets arrive at interfaces
GigabitEthernet1/0/1 and GigabitEthernet1/0/2, their MAC and IP addresses are checked, and then
the packets are checked against the static IP source guard binding entries and, finally, DHCP snooping
entries.
427