Ip Static Binding; Arp Attack Detection - H3C LS-5100-16P-SI-OVS-H3 Configuration

H3C Low-End Ethernet Switches Configuration Examples
ARP Attack Prevention
Note:
Currently, after DHCP snooping is enabled on an H3C low-end Ethernet switch, all the
ports on the switch are DHCP snooping untrusted ports by default. You need to specify
the ports connected to the valid DHCP servers as trusted to ensure that DHCP clients
can obtain valid IP addresses. The trusted ports and the ports connected to DHCP
clients must be in the same VLAN.

1.2.2 IP Static Binding

A DHCP snooping table only records IP-to-MAC bindings of clients that have obtained
IP addresses through DHCP. If a client has a fixed IP address configured, its IP-to-MAC
binding will not be recorded in the DHCP snooping table. The switch supports
configuring IP static bindings, so that you can bind the client's IP and MAC addresses
and the port connected to the client. Thus, ARP packets sent from the client will not be
filtered out through ARP attack detection.

1.2.3 ARP Attack Detection

H3C low-end switches can deliver received ARP packets (request or reply) to the CPU,
and use DHCP snooping to verify the validity of the ARP packets as follows:
If the source IP and MAC addresses, receiving port and its VLAN of an ARP
packet match a DHCP snooping entry or an IP static binding entry, it is considered
a valid ARP packet and is forwarded.
If not, it is considered an invalid ARP packet and discarded.
Note:
A DHCP snooping table only records IP-to-MAC bindings of clients that have
obtained IP addresses through DHCP. If a client with fixed IP address wants to
access the network, you need to configure an IP static binding on the switch, that is,
the binding of the IP and MAC addresses of the client, and the port connected to the
client on the switch.
You can configure an uplink port on a switch as trusted or untrusted to flexibly
implement ARP attack detection for ARP requests and replies received on the port.
The ARP packets received from an ARP trusted port are not detected, while the
ARP packets received from untrusted ports are detected based on the DHCP
snooping table and IP static bindings.
Chapter 1 ARP Attack Prevention Overview
1-5