Configuring Arp Attack Detection; Configuring User Validity Check - HPE FlexNetwork 5510 HI Series Security Configuration Manual

# Enable DHCP relay agent on GigabitEthernet 1/0/2.
[SwitchB-GigabitEthernet1/0/2] dhcp select relay
# Add the DHCP server 10.1.1.1 to DHCP server group 1.
[SwitchB-GigabitEthernet1/0/2] dhcp relay server-address 10.1.1.1
# Enable authorized ARP.
[SwitchB-GigabitEthernet1/0/2] arp authorized enable
[SwitchB-GigabitEthernet1/0/2] quit
# Enable recording of relay entries on the relay agent.
[SwitchB] dhcp relay client-information record
3. Configure Switch C:
<SwitchC> system-view
[SwitchC] ip route-static 10.1.1.0 24 10.10.1.1
[SwitchC] interface gigabitethernet 1/0/2
[SwitchC-GigabitEthernet1/0/2] port link-mode route
[SwitchC-GigabitEthernet1/0/2] ip address dhcp-alloc
[SwitchC-GigabitEthernet1/0/2] quit
Verifying the configuration
# Display authorized ARP information on Switch B.
[SwitchB] display arp all
Type: S-Static
IP Address
10.10.1.2
The output shows that Switch A assigned the IP address 10.10.1.2 to Switch C.
Switch C must use the IP address and MAC address in the authorized ARP entry to communicate
with Switch B. Otherwise, the communication fails. Thus the user validity is ensured.

Configuring ARP attack detection

ARP attack detection enables access devices to block ARP packets from unauthorized clients to
prevent user spoofing and gateway spoofing attacks. ARP attack detection does not check ARP
packets received from ARP trusted ports.
ARP attack detection provides the following features:
•
User validity check.
•
ARP packet validity check.
•
ARP restricted forwarding.
•
ARP attack detection logging.
If both ARP packet validity check and user validity check are enabled, the former one applies first,
and then the latter applies.

Configuring user validity check

Upon receiving an ARP packet from an ARP untrusted interface, the device matches the sender IP
and MAC addresses with the following entries:
•
Static IP source guard bindings
•
DHCP snooping entries
D-Dynamic O-Openflow
MAC Address VLAN
0012-3f86-e94c N/A
M-Multiport
Interface
GE1/0/2
420
I-Invalid
Aging Type
20 D