1-7
Otherwise, the packet is considered invalid and discarded.
3) After you enable ARP detection based on static IP-to-MAC bindings, the device, upon receiving an
ARP packet from an ARP trusted/untrusted port, compares the source IP and MAC addresses of
the ARP packet against the static IP-to-MAC bindings.
z
If an entry with a matching IP address but a different MAC address is found, the ARP packet is
considered invalid and discarded.
z
If an entry with both matching IP and MAC addresses is found, the ARP packet is considered valid
and can pass the detection.
z
If no match is found, the ARP packet is considered valid and can pass the detection.
Follow these steps to enable ARP detection for a VLAN and specify a trusted port:
To do…
Use the command…
Remarks
Enter system view
system-view
—
Enter VLAN view
vlan vlan-id
—
Enable ARP detection for
the VLAN
arp detection enable
Required
Disabled by default. That is, the ARP
packets received on all the ports in the
VLAN will not be checked.
Return to system view
quit
—
Enter Ethernet interface
view
interface interface-type
interface-number
—
Configure the port as a
trusted port
arp detection trust
Optional
The port is an untrusted port by
default.
Return to system view
quit
—
Specify an ARP attack
detection mode
arp detection mode
{
dhcp-snooping
|
dot1x
|
static-bind
} *
Required
No ARP attack detection mode is
specified by default; that is, an ARP
packet is considered as an attack and
discarded.
Configure a static
IP-to-MAC binding for ARP
detection
arp detection static-bind
ip-address mac-address
Optional
Not configured by default.
If the ARP attack detection mode is
static-bind
, you need to configure
static IP-to-MAC bindings for ARP
detection.
