H3C S5830V2 Security Configuration Manual page 13

Configuration guidelines ···································································································································· 215
Configuration procedure ···································································································································· 215
Configuring source MAC-based ARP attack detection ···························································································· 215
Configuration procedure ···································································································································· 215
Displaying and maintaining source MAC-based ARP attack detection ························································· 216
Configuration example ······································································································································· 216
Configuring ARP packet source MAC consistency check ························································································ 218
Configuring ARP active acknowledgement ··············································································································· 218
Configuring ARP detection ·········································································································································· 218
Configuring user validity check ························································································································· 218
Configuring ARP packet validity check ············································································································· 219
Configuring ARP restricted forwarding ············································································································· 220
Displaying and maintaining ARP detection ······································································································ 220
User validity check and ARP packet validity check configuration example ·················································· 221
Configuring ARP automatic scanning and fixed ARP ······························································································· 222
Configuration guidelines ···································································································································· 222
Configuration procedure ···································································································································· 223
Configuring ARP gateway protection ························································································································ 223
Configuration guidelines ···································································································································· 223
Configuration procedure ···································································································································· 223
Configuration example ······································································································································· 224
Configuring ARP filtering ············································································································································· 224
Configuration guidelines ···································································································································· 224
Configuration procedure ···································································································································· 225
Configuration example ······································································································································· 225
Configuring uRPF ····················································································································································· 227
uRPF check modes ························································································································································ 227
uRPF operation ····························································································································································· 227
Network application ···················································································································································· 230
Configuration procedure ············································································································································· 230
Displaying and maintaining uRPF ······························································································································ 231
Configuration example ················································································································································ 231
Network requirements ········································································································································· 231
Configuration procedure ···································································································································· 231
Configuring FIPS······················································································································································ 232
Overview ······································································································································································· 232
Configuration restrictions and guidelines ·················································································································· 232
Configuring FIPS mode ················································································································································ 233
Entering FIPS mode ············································································································································· 233
Configuration changes in FIPS mode ················································································································ 234
FIPS self-tests ································································································································································· 235
Power-up self-tests ················································································································································ 235
Conditional self-tests ············································································································································ 235
Triggering self-tests ·············································································································································· 236
Displaying and maintaining FIPS ······························································································································· 236
FIPS configuration examples ······································································································································· 236
Entering FIPS mode through automatic reboot ································································································· 236
Entering FIPS mode through manual reboot ····································································································· 237
Configuring IPsec ···················································································································································· 240
Overview ······································································································································································· 240
Security protocols and encapsulation modes ··································································································· 241
Security association ············································································································································· 242
Authentication and encryption ··························································································································· 243
vi