Arp Restricted Forwarding Configuration Example - HPE Moonshot 45Gc Security Configuration Manual

[SwitchB-FortyGigE1/1/2] ip source binding ip-address 10.1.1.6 mac-address
0001-0203-0607 vlan 10
[SwitchB-FortyGigE1/1/2] quit
# Enable ARP packet validity check by checking the MAC addresses and IP addresses of ARP
packets.
[SwitchB] arp detection validate dst-mac ip src-mac
After the configurations are completed, Switch B first checks the validity of ARP packets
received on FortyGigE 1/1/1 and FortyGigE 1/1/2. If the ARP packets are confirmed as valid,
the switch performs user validity check by using the static IP source guard bindings and finally
DHCP snooping entries.

ARP restricted forwarding configuration example

Network requirements
As shown in
configured. Port isolation configured on Switch B can take effect for broadcast ARP requests.
Figure 127 Network diagram
Configuration procedure
1. Configure VLAN 10, add interfaces to VLAN 10, and specify the IP address of the VLAN
interface. (Details not shown.)
2. Configure the DHCP server on Switch A, and configure DHCP address pool 0.
<SwitchA> system-view
[SwitchA] dhcp enable
[SwitchA] dhcp server ip-pool 0
[SwitchA-dhcp-pool-0] network 10.1.1.0 mask 255.255.255.0
3. Configure Host A (DHCP client) and Host B. (Details not shown.)
4. Configure Switch B:
# Enable DHCP snooping, and configure FortyGigE 1/1/3 as a DHCP-trusted port.
<SwitchB> system-view
[SwitchB] dhcp snooping enable
[SwitchB] interface fortygige 1/1/3
[SwitchB-FortyGigE1/1/3] dhcp snooping trust
Figure 127, configure ARP restricted forwarding on Switch B where ARP detection is
416