Configuring Mff; Overview - HP 5500 HI Series Configuration Manual

Configuring MFF

Overview

Traditional Ethernet networking solutions use the VLAN technology to isolate users at Layer 2 and to
allow them to communicate at Layer 3. However, when a large number of hosts need to be isolated at
Layer 2, many VLAN resources are occupied, and many IP addresses are used because you have to
assign a network segment to each VLAN and an IP address to each VLAN interface for Layer 3
communication.
MAC-forced forwarding (MFF) provides a solution for Layer 2 isolation and Layer 3 communication
between hosts in the same broadcast domain.
An MFF enabled device intercepts an ARP request and then returns the MAC address of a gateway (or
server) to the sender. In this way, the sender is forced to send packets to the gateway for traffic monitoring
and attack prevention.
Figure 130 Network diagram for MFF
As shown in
Switch B (Ethernet access nodes, or EANs). The MFF enabled EANs forward packets from the hosts to the
gateway for further forwarding. Thus, the hosts, isolated at Layer 2, can communicate at Layer 3 without
knowing the MAC address of each other.
MFF is often used in cooperation with the DHCP snooping, ARP snooping, IP source guard, ARP
detection, and VLAN mapping features to enhance network security by implementing traffic filtering,
Layer 2 isolation, and Layer 3 communication on the access switches.
For information about DHCP snooping, see Layer 3—IP Services Configuration Guide.
For information about ARP snooping, see Layer 3—IP Services Configuration Guide.
For information about IP source guard, see
For information about ARP detection, see
For information about VLAN mapping, see Layer 2—LAN Switching Configuration Guide.
Figure 130, hosts are connected to Switch C (aggregation node) through Switch A and
"Configuring IP source
"Configuring ARP attack
399
guard."
protection."