Configuring Arp Attack Detection For A Vsi - HPE FlexNetwork 10500 Series Security Configuration Manual

Configuring ARP attack detection for a VSI

In VXLAN networks, you can configure a VTEP to perform ARP attack detection in a VSI. ARP attack
detection performs user validity check and ARP packet validity check on ARP packets from ARP
untrusted ACs. For information about ACs, see VXLAN Configuration Guide.
The user validity check and ARP packet validity check mechanisms for a VSI are the same as those
for a VLAN. For more information, see
packet validity
Configuring user validity check for a VSI
When you configure user validity check for a VSI, follow these restrictions and guidelines:
•
Make sure one or more of the following items are configured for user validity check:
User validity check rules.

Static IP source guard bindings.

DHCP snooping.

802.1X.

If none of the items is configured, all incoming ARP packets on ARP untrusted ACs are
discarded.
•
Specify an IP address and a MAC address where ARP attack detection is enabled for an IP
source guard binding. Otherwise, no ARP packets can match the IP source guard binding.
To configure user validity check for a VSI:
Step
1. Enter system view.
2. (Optional.) Configure a user
validity check rule.
3. Enter VSI view.
4. Enable ARP attack detection.
5. Return to system view.
6. (Optional.) Enter Layer 2
Ethernet interface view or
Layer 2 aggregate interface
view.
7. (Optional.) Enter Ethernet
service instance view.
8. (Optional.) Configure the AC as
a trusted AC excluded from
ARP attack detection.
Configuring ARP packet validity check for a VSI
Step
1. Enter system view.
2. Enter VSI view.
check."
Command
system-view
arp detection rule rule-id
{ deny | permit } ip
{ ip-address [ mask ] | any }
mac { mac-address [ mask ] |
any } [ vlan vlan-id ]
vsi vsi-name
arp detection enable
quit
interface interface-type
interface-number
service-instance instance-id
arp detection trust
Command
system-view
vsi vsi-name
"Configuring user validity
523
check" and "Configuring ARP
Remarks
N/A
By default, no user validity check
rule is configured.
N/A
By default, ARP attack detection is
disabled.
N/A
N/A
N/A
By default, an AC is untrusted.
Remarks
N/A
N/A