Configuring User Validity Check; Configuring Arp Packet Validity Check - HPE Moonshot 45Gc Security Configuration Manual

Configuring user validity check

The device checks user validity upon receiving an ARP packet from an ARP untrusted interface as
follows:
1. Uses the user validity check rules to match the sender IP and MAC addresses of the ARP
packet.
If a match is found, the device processes the ARP packet according to the rule.
If no match is found, proceeds to step 2.
2. Uses static IP source guard bindings and DHCP snooping entries to match the sender IP and
MAC addresses of the ARP packet.
If a match is found, the device forwards the ARP packet.
If no match is found, the device discards the ARP packet.
Static IP source guard bindings are created by using the ip source binding command. For more
information, see "Configuring IP source guard."
DHCP snooping entries are automatically generated by DHCP snooping. For more information, see
Layer 3—IP Services Configuration Guide.
Configuration guidelines
You must specify a VLAN for an IP source guard binding. Otherwise, no ARP packets can match the
IP source guard binding.
Configuration procedure
To configure user validity check:
Step
1. Enter system view.
2. (Optional.) Configure a user
validity check rule.
3. Enter VLAN view.
4. Enable ARP detection.
5. Return to system view.
6. Enter Layer 2 Ethernet
interface view or Layer 2
aggregate interface view.
7. (Optional.) Configure the
interface as a trusted interface
excluded from ARP detection.

Configuring ARP packet validity check

Enable validity check for ARP packets received on untrusted ports and specify the following objects
to be checked:
Command
system-view
arp detection rule rule-id
{ deny | permit } ip { any |
ip-address
[ ip-address-mask ] } mac
{ any | mac-address
[ mac-address-mask ] } [ vlan
vlan-id ]
vlan vlan-id
arp detection enable
quit
interface interface-type
interface-number
arp detection trust
412
Remarks
N/A
By default, no user validity check
rule is configured.
N/A
By default, ARP detection is
disabled.
N/A
N/A
By default, an interface is untrusted.