Configuring User Validity Check - HPE FlexNetwork 10500 Series Security Configuration Manual

ARP attack detection provides the following features:
•
User validity check.
•
ARP packet validity check.
•
ARP restricted forwarding.
•
ARP attack detection logging.
•
ARP packet ingress port ignoring during user validity check.
•
ARP attack detection for a VSI.
If both ARP packet validity check and user validity check are enabled, the former one applies first,
and then the latter applies.
Do not configure ARP attack detection together with ARP snooping. Otherwise, ARP snooping
entries cannot be generated.

Configuring user validity check

User validity check compares the sender IP and sender MAC in the received ARP packet with the
matching criteria in the following order:
1. User validity check rules.
If a match is found, the device processes the ARP packet according to the rule.

If no match is found or no user validity check rule is configured, proceeds to step 2.

2. Static IP source guard bindings, DHCP snooping entries, and 802.1X security entries.
If a match is found, the device forwards the ARP packet.

If no match is found, the device discards the ARP packet.

Static IP source guard bindings are created by using the ip source binding command. For more
information, see
DHCP snooping entries are automatically generated by DHCP snooping. For more information, see
Layer 3—IP Services Configuration Guide.
802.1X security entries record the IP-to-MAC mappings for 802.1X clients. After a client passes
802.1X authentication and uploads its IP address to an ARP attack detection enabled device, the
device automatically generates an 802.1X security entry. The 802.1X client must be enabled to
upload its IP address to the device. For more information, see
Configuration guidelines
When you configure user validity check for a VLAN, follow these guidelines:
•
Make sure one or more of the following items are configured for user validity check:
User validity check rules.

Static IP source guard bindings.

DHCP snooping.

802.1X.

If none of the items is configured, all incoming ARP packets on ARP untrusted interfaces are
discarded.
•
Specify an IP address and a MAC address where ARP attack detection is enabled for an IP
source guard binding. Otherwise, no ARP packets can match the IP source guard binding.
Configuration procedure
To configure user validity check for a VLAN:
"Configuring IP source guard."
520
"Configuring 802.1X."