Configuring Arp Automatic Scanning And Fixed Arp - H3C S5120-HI Security Configuration Manual

[SwitchB] vlan 10
[SwitchB-vlan10] arp detection enable
# Configure GigabitEthernet 1/0/3 as an ARP-trusted port.
[SwitchB-vlan10] interface gigabitethernet 1/0/3
[SwitchB-GigabitEthernet1/0/3] arp detection trust
[SwitchB-GigabitEthernet1/0/3] quit
# Configure a static IP source guard entry on interface GigabitEthernet 1/0/2.
[SwitchB] interface gigabitethernet 1/0/2
[SwitchB-GigabitEthernet1/0/2] ip source binding ip-address 10.1.1.6 mac-address
0001-0203-0607 vlan 10
[SwitchB-GigabitEthernet1/0/2] quit
# Enable the checking of the MAC addresses and IP addresses of ARP packets.
[SwitchB] arp detection validate dst-mac ip src-mac
# Configure port isolation.
[SwitchB] interface gigabitethernet 1/0/1
[SwitchB-GigabitEthernet1/0/1] port-isolate enable
[SwitchB-GigabitEthernet1/0/1] quit
[SwitchB] interface gigabitethernet 1/0/2
[SwitchB-GigabitEthernet1/0/2] port-isolate enable
[SwitchB-GigabitEthernet1/0/2] quit
After the preceding configurations are complete, ARP packets received on interfaces
GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2 have their MAC and IP addresses checked
first, and then are checked against the static IP source guard binding entries and finally DHCP
snooping entries. However, ARP broadcast requests sent from Host A can pass the check on Switch
B and reach Host B. Port isolation fails.
# Configure ARP restricted forwarding.
[SwitchB] vlan 10
[SwitchB-vlan10] arp restricted-forwarding enable
[SwitchB-vlan10] quit
After the configuration, Switch B forwards ARP broadcast requests from Host A to Switch A
through the trusted port GigabitEthernet 1/0/3, and thus Host B cannot receive such packets. Port
isolation works normally.

Configuring ARP automatic scanning and fixed ARP

ARP automatic scanning is usually used together with the fixed ARP feature.
With ARP automatic scanning enabled on an interface, the device automatically scans neighbors on the
interface, sends ARP requests to the neighbors, obtains their MAC addresses, and creates dynamic ARP
entries.
Fixed ARP allows the device to change the existing dynamic ARP entries (including those generated
through ARP automatic scanning) into static ARP entries. The fixed ARP feature effectively prevents ARP
entries from being modified by attackers.
H3C recommends that you use ARP automatic scanning and fixed ARP in a small-scale network such as
a cybercafe.
334