H3C S5500-SI Series, Operation Manual

Page: 800 / 1217

1-6
Configuring ARP Detection
Introduction
The ARP detection feature is mainly configured on an access device to allow only the ARP packets of
authorized clients to be forwarded, hence preventing user spoofing and gateway spoofing.
ARP detection includes ARP detection based on specified objects, and ARP detection based on static
IP source guard binding entries/DHCP snooping entries/802.1X security entries/OUI MAC addresses.
If both the ARP detection based on specified objects and the ARP detection based on static IP Source
Guard binding entries/DHCP snooping entries/802.1X security entries/OUI MAC addresses are
enabled, the former one applies first, and then the latter applies.
Configuring ARP Detection Based on Specified Objects
With this feature configured, the device permits the ARP packets received from an ARP trusted port to
pass directly, and checks the ARP packets received from an ARP untrusted port. You can specify
objects in the ARP packets to be detected. The objects involve:
z
src-mac: Checks whether the sender MAC address of an ARP packet is identical to the source
MAC address in the Ethernet header. If they are identical, the packet is forwarded; otherwise, the
packet is discarded.
z
dst-mac: Checks the target MAC address of ARP replies. If the target MAC address is all-zero,
all-one, or inconsistent with the destination MAC address in the Ethernet header, the packet is
considered invalid and discarded.
z
ip: Checks both the source and destination IP addresses in an ARP packet. The all-zero, all-one or
multicast IP addresses are considered invalid and the corresponding packets are discarded. With
this object specified, the source and destination IP addresses of ARP replies, and the source IP
address of ARP requests are checked.
Follow these steps to configure ARP detection based on specified objects:
To do… Use the command… Remarks
Enter system view system-view —
Enter VLAN view vlan vlan-id —
Enable ARP detection for the
VLAN
arp detection enable
Required
Disabled by default.
Return to system view quit —
Specify objects for ARP
detection arp detection validate
{ dst-mac | ip | src-mac } *
Required
Not specified by default.
Enter Ethernet interface view
interface interface-type
interface-number
—