218
Configuring ARP packet source MAC consistency
check
This feature enables a gateway to filter out ARP packets whose source MAC address in the Ethernet
header is different from the sender MAC address in the message body, so that the gateway can learn
correct ARP entries.
To enable ARP packet source MAC address consistency check:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enable ARP packet source MAC address
consistency check.
arp valid-check enable
By default, ARP packet source
MAC address consistency check
is disabled.
Configuring ARP active acknowledgement
Configure this feature on gateway devices to prevent user spoofing.
ARP active acknowledgement prevents a gateway from generating incorrect ARP entries. For more
information about its working mechanism, see
ARP Attack Protection Technology White Paper
.
To configure ARP active acknowledgement:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enable the ARP active
acknowledgement function.
arp active-ack enable
By default, ARP active acknowledgement
function is disabled.
Configuring ARP detection
ARP detection enables access devices to block ARP packets from unauthorized clients to prevent user
spoofing and gateway spoofing attacks. ARP detection does not check ARP packets received from ARP
trusted ports.
ARP detection provides the user validity check and ARP packet validity check functions.
If both ARP packet validity check and user validity check are enabled, the former one applies first, and
then the latter applies.
Configuring user validity check
Upon receiving an ARP packet from an ARP untrusted interface, the device compares the sender IP and
MAC addresses against the static IP source guard binding entries and the DHCP snooping entries. If a
match is found from those entries, the ARP packet is considered valid and is forwarded. If no match is
found, the ARP packet is considered invalid and is discarded.