HP ProCurve J8766A Release Note page 73

DHCP snooping intercepts and examines DHCP packets received on switch ports before
forwarding the packets. DHCP packets are checked against a database of DHCP binding infor-
mation. Each binding consists of a client MAC address, port number, VLAN identifier, leased IP
address, and lease time. The DHCP binding database is used to validate packets by other security
features on the switch.
If you have already enabled DHCP snooping on a switch, you may also want to add static IP-to-
MAC address bindings to the DHCP snooping database so that ARP packets from devices that
have been assigned static IP addresses are also verified.
Supports additional checks to verify source MAC address, destination MAC address, and IP
■
address.
ARP packets that contain invalid IP addresses or MAC addresses in their body that do not match
the addresses in the Ethernet header are dropped.
When dynamic ARP protection is enabled, only ARP request and reply packets with valid IP-to-MAC
address bindings in their packet header are relayed and used to update the ARP cache.
Dynamic ARP protection is implemented in the following ways on a switch:
You can configure dynamic ARP protection only from the CLI; you cannot configure this feature
■
from the web or menu interfaces.
Line rate—Dynamic ARP protection copies ARP packets to the switch CPU, evaluates the
■
packets, and then re-forwards them through the switch software. During this process, if ARP
packets are received at too high a line rate, some ARP packets may be dropped and will need to
be retransmitted.
■ The SNMP MIB, HP-ICF-ARP-PROTECT-MIB, is created to configure dynamic ARP protection
and to report ARP packet-forwarding status and counters.
Enabling Dynamic ARP Protection
To enable dynamic ARP protection for VLAN traffic on a routing switch, enter the arp protect vlan
command at the global configuration level.
Syntax: [no] arp protect vlan [vlan-range]
vlan-range
An example of the arp protect vlan command is shown here:
ProCurve(config)# arp protect vlan 1-101
Configuring Trusted Ports
In a similar way to DHCP snooping, dynamic ARP protection allows you to configure VLAN interfaces
in two categories: trusted and untrusted ports. ARP packets received on trusted ports are forwarded
without validation.
Specifies a VLAN ID or a range of VLAN IDs from
one to 4094; for example, 1–200.
Enhancements
Release L.10.28 Enhancements
67