Configuring Arp Packet Validity Check - HPE FlexNetwork 10500 Series Security Configuration Manual

Step
1. Enter system view.
2. (Optional.) Configure a user
validity check rule.
3. Enter VLAN view.
4. Enable ARP attack detection.
5. Return to system view.
6. Enter Layer 2 Ethernet
interface view or Layer 2
aggregate interface view.
7. (Optional.) Configure the
interface as a trusted interface
excluded from ARP attack
detection.

Configuring ARP packet validity check

Enable validity check for ARP packets received on untrusted interfaces and specify the following
objects to be checked:
•
src-mac—Checks whether the sender MAC address in the message body is identical to the
source MAC address in the Ethernet header. If they are identical, the packet is forwarded.
Otherwise, the packet is discarded.
•
dst-mac—Checks the target MAC address of ARP replies. If the target MAC address is all-zero,
all-one, or inconsistent with the destination MAC address in the Ethernet header, the packet is
considered invalid and discarded.
•
ip—Checks the sender and target IP addresses of ARP replies, and the sender IP address of
ARP requests. All-one or multicast IP addresses are considered invalid and the corresponding
packets are discarded.
To configure ARP packet validity check for a VLAN:
Step
1. Enter system view.
2. Enter VLAN view.
3. Enable ARP attack
detection.
4. Return to system view.
5. Enable ARP packet validity
check and specify the
objects to be checked.
6. Enter Layer 2 Ethernet
interface view or Layer 2
aggregate interface view.
Command
system-view
arp detection rule rule-id
{ deny | permit } ip
{ ip-address [ mask ] | any }
mac { mac-address [ mask ] |
any } [ vlan vlan-id ]
vlan vlan-id
arp detection enable
quit
interface interface-type
interface-number
arp detection trust
Command
system-view
vlan vlan-id
arp detection enable
quit
arp detection validate { dst-mac
| ip | src-mac } *
interface interface-type
interface-number
521
Remarks
N/A
By default, no user validity check
rule is configured.
N/A
By default, ARP attack detection is
disabled.
N/A
N/A
By default, an interface is untrusted.
Remarks
N/A
N/A
By default, ARP attack detection
is disabled.
N/A
By default, ARP packet validity
check is disabled.
N/A