Arp-Protect; Overview; Command Structure - HP ProCurve 5400zl Reference Manual

OVERVIEW

Category:
Primary context:
Related Commands
Usage: [no] arp-protect [trust [ethernet] PORT-LIST|
Description: Configure Dynamic ARP Protection.
Parameters:
trust [ethernet] PORT-LIST
validate <ip|dest-mac|src-mac> -- Configure addiional ARP packet checks.
vlan VLAN-ID-RANGE

COMMAND STRUCTURE

■ [no] arp-protect
■ [no] arp-protect
dest-mac
■
header does not match the target MAC address in the body of the packet.
ip -- Drop any ARP request with an invalid sender IP address. Drop any ARP response with an
■
invalid target IP address. Invalid IP addresses include 0.0.0.0, 255.255.255.255, all IP multicast
addresses, and all class E IP addresses.
© 2009 Hewlett-Packard Development Company, L.P.
config
validate <ip|destination-mac|src-mac>|
vlan VLAN-ID-RANGE]
To Enable/disable ARP Protection on the switch execute the
[no] arp-protect command. Dynamic ARP Protection will not be
enabled on any VLAN if it is not enabled on the switch.
By default Dynamic ARP Protection is disabled.
To configure which VLANs are to be protected execute the
'arp-protect vlan' command. By default Dynamic ARP Protection
is disabled on all VLANs.
Dynamic ARP Protection divides ports into two categories:
untrusted and trusted. ARP packets received on trusted ports
are forwarded without validation.
ARP packets received on the untrusted ports of a protected VLAN
are intercepted and validated before being forwarded.
By default ports are untrusted.
Dynamic ARP Protection validates ARP packets based on the
IP-to-MAC binding database maintained by DHCP snooping. If DHCP
snooping is not enabled then a loss of connectivity will result
since the database will contain no bindings. For devices that do
not use DHCP to obtain their IP configuration static bindings can
be added manually to the database with the 'ip source-binding'
command.
Dynamic ARP Protection can also be configured to drop ARP packets
that contain invalid IP addresses or when the MAC addresses in the
body of the ARP packet do not match those in the ethernet header.
trust -- Configure port(s) as trusted or untrusted. ([ethernet] PORT-LIST)
validate -- Configure additional ARP Protection validation checks.
-- Drop any ARP response packet in which the destination MAC address in the ethernet
-- Configure ports as trusted or untrusted.
-- Enable/disable ARP Protection on VLANs
(p. 66)

arp-protect

(p. 66)
(p. 66)
(p. 66)
65