HP 3600 v2 Series Security Configuration Manual page 10

ARP defense against IP packet attack configuration example ········································································ 332
Configuring ARP packet rate limit ······························································································································ 334
Introduction ·························································································································································· 334
Configuring ARP packet rate limit ····················································································································· 334
Configuring source MAC address based ARP attack detection·············································································· 335
Introduction ·························································································································································· 335
Configuration procedure ···································································································································· 335
Displaying and maintaining source MAC address based ARP attack detection ·········································· 336
Source MAC address based ARP attack detection configuration example ·················································· 336
Configuring ARP packet source MAC address consistency check ········································································· 337
Introduction ·························································································································································· 337
Configuration procedure ···································································································································· 337
Configuring ARP active acknowledgement ··············································································································· 337
Introduction ·························································································································································· 337
Configuration procedure ···································································································································· 338
Configuring ARP detection ·········································································································································· 338
Introduction ·························································································································································· 338
Enabling ARP detection based on static IP source guard binding entries/DHCP snooping entries/802.1x
security entries/OUI MAC addresses ··············································································································· 338
Configuring ARP detection based on specified objects ·················································································· 339
Configuring ARP restricted forwarding ············································································································· 340
Displaying and maintaining ARP detection ······································································································ 340
ARP detection configuration example I ············································································································· 341
ARP detection configuration example II ············································································································ 342
ARP restricted forwarding configuration example ··························································································· 343
Configuring ARP automatic scanning and fixed ARP ······························································································· 345
Introduction ·························································································································································· 345
Configuration procedure ···································································································································· 345
Configuring ARP gateway protection ························································································································ 346
Introduction ·························································································································································· 346
Configuration procedure ···································································································································· 346
ARP gateway protection configuration example ······························································································ 347
Configuring ARP filtering ············································································································································· 348
Introduction ·························································································································································· 348
Configuration procedure ···································································································································· 348
ARP filtering configuration example ·················································································································· 348
ND attack defense configuration ··························································································································· 350
Introduction to ND attack defense ······························································································································ 350
Enabling source MAC consistency check for ND packets ······················································································· 351
Configuring the ND detection function ······················································································································ 351
Introduction to ND detection ······························································································································ 351
Configuring ND detection ·································································································································· 352
Displaying and maintaining ND detection ······································································································· 352
ND detection configuration example ························································································································· 353
URPF configuration ·················································································································································· 355
URPF overview ······························································································································································ 355
What is URPF ······················································································································································· 355
URPF check modes ·············································································································································· 355
How URPF works ················································································································································· 356
Network application ··········································································································································· 359
Configuring URPF ························································································································································· 359
URPF configuration example ······································································································································· 359
viii