Arp Detection Configuration Commands; Arp Detection - HPE FlexNetwork HSR6800 Security Command Reference

ARP detection configuration commands

NOTE:
The commands of this feature are supported only when SAP modules operate in bridge mode.

arp detection

Use arp detection to configure a user validity check rule.
Use undo arp detection to restore the default.
Syntax
arp detection id-number { deny | permit } ip { any | ip-address [ ip-address-mask ] } mac { any |
mac-address [ mac-address-mask ] } [ vlan vlan-id ]
undo arp detection id-number
Default
No user validity check rule is specified.
Views
System view
Default command level
2: System level
Parameters
id-number: Specifies the sequence number of the user validity check rule, in the range of 0 to 511.
The smaller the value, the higher the priority.
deny: Denies the matching ARP packets.
permit: Permits the matching ARP packets.
ip { any | ip-address [ ip-address-mask ] }: Specifies the sender IP address range.
•
any: Matches any sender IP address.
•
ip-address: Matches a sender IP address.
•
ip-address-mask: Specifies the mask for the sender IP address in dotted decimal format. If no
mask is specified, the ip-address argument specifies a host IP address.
mac { any | mac-address [ mac-address-mask ] }: Specifies the sender MAC address range.
•
any: Matches any sender MAC address.
•
mac-address: Matches a sender MAC address, in the format of H-H-H.
•
mac-address-mask: Specifies the mask for the sender MAC address, in the format of H-H-H.
•
vlan vlan-id: Specifies the ID of a VLAN where this rule applies, in the range of 1 to 4094.
Usage guidelines
Upon receiving an ARP packet, user validity check first compares the sender IP and MAC addresses
of the ARP packet against user validity check rules. If a matching rule is found, the ARP packet is
processed according to the rule. If no matching rule is found, the device compares the ARP packet's
sender IP and MAC addresses against the static IP source guard binding entries, the DHCP
snooping entries, 802.1X security entries, and OUI MAC addresses in turn.
462