Configuring Arp Snooping; Overview; Feature And Hardware Compatibility; Configuration Procedure - HPE FlexNetwork MSR Series Comware 7 Layer 3 - Ip Services Configuration Manuals

Configuring ARP snooping

This feature is supported only on the following ports:
•
Layer 2 Ethernet ports on Ethernet switching modules.
•
Fixed Layer 2 Ethernet ports of MSR2004-24 and MSR2004-48 routers.

Overview

ARP snooping is used in Layer 2 switching networks. It creates ARP snooping entries by using
information in ARP packets. ARP fast-reply and manual-mode MFF can use the ARP snooping
entries. For more information about MFF, see Security Configuration Guide.
If you enable ARP snooping for a VLAN, ARP packets received in the VLAN are redirected to the
CPU. The CPU uses the sender IP and MAC addresses of the ARP packets, and receiving VLAN
and port to create ARP snooping entries.
The aging timer and valid period of an ARP snooping entry are 25 minutes and 15 minutes. If an ARP
snooping entry is not updated in 12 minutes, the device sends an ARP request. The ARP request
uses the IP address of the entry as the target IP address. If an ARP snooping entry is not updated in
15 minutes, it becomes invalid and cannot be used. After that, if an ARP packet matching the entry is
received, the entry becomes valid, and its aging timer restarts. If the aging timer of an ARP snooping
entry expires, the entry is removed.
An attack occurs if an ARP packet has the same sender IP address as a valid ARP snooping entry
but a different sender MAC address. The ARP snooping entry becomes invalid, and it is removed in
1 minute.

Feature and hardware compatibility

Hardware
MSR954(JH296A/JH297A/JH298A/JH299A/JH373A)
MSR958(JH300A/JH301A)
MSR1002-4/1003-8S
MSR2003
MSR2004-24/2004-48
MSR3012/3024/3044/3064
MSR4060/4080

Configuration procedure

To enable ARP snooping for a VLAN:
Step
1. Enter system view.
2. Enter VLAN view.
Command
system-view
vlan vlan-id
16
ARP snooping compatibility
No
No
No
No
Yes
Yes
Yes
Remarks
N/A
N/A