Configuring Arp Packet Validity Check - HP FlexFabric 5700 Series Security Configuration Manual

DHCP snooping entries are automatically generated by DHCP snooping. For more information, see
Layer 3—IP Services Configuration Guide.
Configuration guidelines
You must specify a VLAN for an IP source guard binding. Otherwise, no ARP packets can match the IP
source guard binding.
Configuration procedure
To configure user validity check:
Step
1. Enter system view.
2. (Optional.) Configure a user
validity check rule.
3. Enter VLAN view.
4. Enable ARP detection.
5. Return to system view.
6. Enter Layer 2 Ethernet interface
view or Layer 2 aggregate
interface view.
7. (Optional.) Configure the
interface as a trusted interface
excluded from ARP detection.

Configuring ARP packet validity check

Enable validity check for ARP packets received on untrusted ports and specify the following objects to be
checked:
src-mac—Checks whether the sender MAC address in the message body is identical to the source
•
MAC address in the Ethernet header. If they are identical, the packet is forwarded. Otherwise, the
packet is discarded.
dst-mac—Checks the target MAC address of ARP replies. If the target MAC address is all-zero,
•
all-one, or inconsistent with the destination MAC address in the Ethernet header, the packet is
considered invalid and discarded.
ip—Checks the sender and target IP addresses of ARP replies, and the sender IP address of ARP
•
requests. All-one, or multicast IP addresses are considered invalid and the corresponding packets
are discarded.
To configure ARP packet validity check:
Step
1. Enter system view.
Command
system-view
arp detection rule rule-id
{ deny | permit } ip { any |
ip-address
[ ip-address-mask ] } mac { any
| mac-address
[ mac-address-mask ] } [ vlan
vlan-id ]
vlan vlan-id
arp detection enable
quit
interface interface-type
interface-number
arp detection trust
Command
system-view
365
Remarks
N/A
By default, no user validity check rule
is configured.
N/A
By default, ARP detection is disabled.
N/A
N/A
By default, an interface is untrusted.
Remarks
N/A