HPE FlexNetwork 7500 Series Security Configuration Manual page 11

Enabling IPv6SG on an interface ··········································································································· 406
Configuring a static IPv6SG binding ······································································································ 407
Displaying and maintaining IPSG ·················································································································· 407
IPSG configuration examples ························································································································ 408
Static IPv4SG configuration example ····································································································· 408
Dynamic IPv4SG using DHCP snooping configuration example ··························································· 410
Dynamic IPv4SG using DHCP relay agent configuration example ························································ 411
Static IPv6SG configuration example ····································································································· 412
Dynamic IPv6SG using DHCPv6 snooping configuration example ······················································· 412
Dynamic IPv6SG using DHCPv6 relay agent configuration example ···················································· 413
Configuring ARP attack protection ······························································ 415
ARP attack protection configuration task list ·································································································· 415
Configuring unresolvable IP attack protection ······························································································· 415
Configuring ARP source suppression ···································································································· 416
Configuring ARP blackhole routing ········································································································ 416
Displaying and maintaining unresolvable IP attack protection ······························································· 416
Configuration example ··························································································································· 416
Configuring ARP packet rate limit ·················································································································· 417
Configuration guidelines ························································································································· 417
Configuration procedure ························································································································· 418
Configuring source MAC-based ARP attack detection ·················································································· 418
Configuration procedure ························································································································· 419
Displaying and maintaining source MAC-based ARP attack detection ·················································· 419
Configuration example ··························································································································· 420
Configuring ARP packet source MAC consistency check ·············································································· 421
Configuring ARP active acknowledgement ···································································································· 421
Configuring authorized ARP ·························································································································· 422
Configuration procedure ························································································································· 422
Configuration example (on a DHCP server) ··························································································· 422
Configuration example (on a DHCP relay agent) ··················································································· 423
Configuring ARP attack detection ·················································································································· 424
Configuring user validity check ·············································································································· 425
Configuring ARP packet validity check ·································································································· 426
Configuring ARP restricted forwarding ··································································································· 427
Enabling ARP attack detection logging ·································································································· 427
Displaying and maintaining ARP attack detection ·················································································· 427
User validity check and ARP packet validity check configuration example ············································ 428
ARP restricted forwarding configuration example ·················································································· 429
Configuring ARP scanning and fixed ARP ····································································································· 431
Configuration restrictions and guidelines ······························································································· 431
Configuration procedure ························································································································· 431
Configuring ARP gateway protection ············································································································· 431
Configuration guidelines ························································································································· 432
Configuration procedure ························································································································· 432
Configuration example ··························································································································· 432
Configuring ARP filtering ································································································································ 433
Configuration guidelines ························································································································· 433
Configuration procedure ························································································································· 433
Configuration example ··························································································································· 433
Configuring ARP sender IP address checking ······························································································· 434
Configuring ND attack defense ··································································· 436
Overview ························································································································································ 436
ND attack defense configuration task list ······································································································· 436
Enabling source MAC consistency check for ND messages ········································································· 436
Configuring ND attack detection ···················································································································· 437
About ND attack detection ····················································································································· 437
Configuration guidelines ························································································································· 437
Configuration procedure ························································································································· 438
Displaying and maintaining ND attack detection ···················································································· 438
ND attack detection configuration example ···························································································· 438
ix