387
After the configuration is complete, Switch B will discard the ARP packets whose source IP address is that
of the gateway.
Configuring ARP filtering
To prevent gateway spoofing and user spoofing, the ARP filtering feature controls the forwarding of ARP
packets on a port.
The port checks the sender IP and MAC addresses in a received ARP packet against configured ARP
filtering entries. If a match is found, the packet is handled normally. If not, the packet is discarded.
Configuration guidelines
Follow these guidelines when you configure ARP filtering:
•
You can configure up to eight ARP filtering entries on a port.
•
Commands
arp filter source
and
arp filter binding
cannot be both configured on a port.
•
If ARP filtering works with ARP detection, and ARP snooping, ARP filtering applies first.
Configuration procedure
To configure ARP filtering:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enter Layer 2 Ethernet interface
view/Layer 2 aggregate interface
view.
interface
interface-type
interface-number
N/A
3.
Configure an ARP filtering entry.
arp filter binding
ip-address
mac-address
Not configured by default
Configuration example
Network requirements
As shown in
, the IP and MAC addresses of Host A are 10.1.1.2 and 000f-e349-1233. The IP
and MAC addresses of Host B are 10.1.1.3 and 000f-e349-1234.
Configure ARP filtering on GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2 of Switch B to permit
specific ARP packets only.
