Configuring Arp Detection; Introduction - HP 12500 Series Configuration Manual

[SwitchB-GigabitEthernet3/0/1] quit
[SwitchB] interface GigabitEthernet 3/0/2
[SwitchB-GigabitEthernet3/0/2] port link-mode route
[SwitchB-GigabitEthernet3/0/2] ip address 10.10.1.1 24
# Enable DHCP relay agent on GigabitEthernet 3/0/2.
[SwitchB-GigabitEthernet3/0/2] dhcp select relay
[SwitchB-GigabitEthernet3/0/2] quit
# Add the DHCP server 10.1.1.1 to DHCP server group 1.
[SwitchB] dhcp relay server-group 1 ip 10.1.1.1
# Correlate GigabitEthernet 3/0/2 to DHCP server group 1.
[SwitchB] interface GigabitEthernet 3/0/2
[SwitchB-GigabitEthernet3/0/2] dhcp relay server-select 1
# Configure the DHCP server to support authorized ARP.
[SwitchB-GigabitEthernet3/0/2] dhcp update arp
# Enable authorized ARP.
[SwitchB-GigabitEthernet3/0/2] arp authorized enable
[SwitchB-GigabitEthernet3/0/2] quit
After Host obtains the IP address from Switch A, display the authorized ARP information on Switch
3.
B.
[SwitchB] display arp all
IP Address
10.10.1.2
The output shows that Switch A assigned IP address 10.10.1.2 to Host.
After that, Host must use the IP address and MAC address that are consistent with those in the
authorized ARP entry to communicate with Switch B. Otherwise, the communication fails. Thus the
client validity is ensured.

Configuring ARP detection

Introduction

The ARP detection feature is mainly configured on an access device to allow only the ARP packets of
authorized clients to be forwarded and prevent user spoofing and gateway spoofing.
ARP detection includes ARP detection based on static IP source guard binding entries/DHCP snooping
entries/802.1X security entries/OUI MAC addresses, ARP detection based on specified objects, and
ARP restricted forwarding.
If both the ARP detection based on specified objects and the ARP detection based on static IP source
guard binding entries/DHCP snooping entries/802.1X security entries/OUI MAC addresses are
enabled, the former one applies first, and then the latter applies.
Type: S-Static D-Dynamic
MAC Address VLAN ID
0012-3f86-e94c N/A
273
A-Authorized
Interface
GE3/0/2
M-Multiport
Aging Type
2 A