Configuring Arp Packet Validity Check; Configuring Arp Restricted Forwarding - HP FlexNetwork 10500 Series Security Configuration Manual

Step
7. (Optional.) Configure the
interface as a trusted interface
excluded from ARP detection.

Configuring ARP packet validity check

Enable validity check for ARP packets received on untrusted interfaces and specify the following
objects to be checked:
•
src-mac—Checks whether the sender MAC address in the message body is identical to the
source MAC address in the Ethernet header. If they are identical, the packet is forwarded.
Otherwise, the packet is discarded.
•
dst-mac—Checks the target MAC address of ARP replies. If the target MAC address is all-zero,
all-one, or inconsistent with the destination MAC address in the Ethernet header, the packet is
considered invalid and discarded.
•
ip—Checks the sender and target IP addresses of ARP replies, and the sender IP address of
ARP requests. All-one or multicast IP addresses are considered invalid and the corresponding
packets are discarded.
To configure ARP packet validity check:
Step
1. Enter system view.
2. Enter VLAN view.
3. Enable ARP detection.
4. Return to system view.
5. Enable ARP packet validity check
and specify the objects to be
checked.
6. Enter Layer 2 Ethernet interface
view or Layer 2 aggregate
interface view.
7. (Optional.) Configure the interface
as a trusted interface excluded
from ARP detection.

Configuring ARP restricted forwarding

NOTE:
ARP restricted forwarding does not apply to ARP packets with multiport MAC as their destination
MAC addresses.
ARP restricted forwarding controls the forwarding of ARP packets that are received on untrusted
interfaces and have passed user validity check as follows:
•
If the packets are ARP requests, they are forwarded through the trusted interface.
•
If the packets are ARP replies, they are forwarded according to their destination MAC address.
If no match is found in the MAC address table, they are forwarded through the trusted interface.
Configure user validity check before you configure ARP restricted forwarding.
Command
arp detection trust
Command
system-view
vlan vlan-id
arp detection enable
quit
arp detection validate
{ dst-mac | ip | src-mac }
*
interface interface-type
interface-number
arp detection trust
439
Remarks
By default, an interface is
untrusted.
Remarks
N/A
N/A
By default, ARP detection is
disabled.
N/A
By default, ARP packet validity
check is disabled.
N/A
By default, an interface is untrusted.