Configuring Arp Restricted Forwarding; Enabling Arp Attack Detection Logging; Displaying And Maintaining Arp Attack Detection - HPE FlexNetwork 7500 Series Security Configuration Manual

Configuring ARP restricted forwarding

NOTE:
ARP restricted forwarding does not apply to ARP packets with multiport MAC as their destination
MAC addresses.
ARP restricted forwarding controls the forwarding of ARP packets that are received on untrusted
interfaces and have passed user validity check as follows:
•
If the packets are ARP requests, they are forwarded through the trusted interface.
•
If the packets are ARP replies, they are forwarded according to their destination MAC address.
If no match is found in the MAC address table, they are forwarded through the trusted interface.
Configure user validity check before you configure ARP restricted forwarding.
To enable ARP restricted forwarding:
Step
1. Enter system view.
2. Enter VLAN view.
3. Enable ARP restricted forwarding.

Enabling ARP attack detection logging

The ARP attack detection logging feature enables a device to generate ARP attack detection log
messages when illegal ARP packets are detected. An ARP attack detection log message contains
the following information:
1. Receiving interface of the ARP packets.
2. Sender IP address.
3. Total number of dropped ARP packets.
To enable ARP attack detection logging:
Step
1. Enter system view.
2. Enable ARP attack
detection logging.

Displaying and maintaining ARP attack detection

Execute display commands in any view and reset commands in user view.
Task
Display the VLANs enabled with
ARP attack detection.
Display the ARP attack detection
statistics.
Clear the ARP attack detection
Command
system-view
vlan vlan-id
arp restricted-forwarding
enable
Command
system-view
arp detection log enable
Command
display arp detection
display arp detection statistics [ interface interface-type
interface-number ]
reset arp detection statistics [ interface interface-type
427
Remarks
N/A
N/A
By default, ARP restricted
forwarding is disabled.
Remarks
N/A
By default, ARP attack detection
logging is disabled.