412
Configuring user validity check
The device checks user validity upon receiving an ARP packet from an ARP untrusted interface as
follows:
1.
Uses the user validity check rules to match the sender IP and MAC addresses of the ARP
packet.
{
If a match is found, the device processes the ARP packet according to the rule.
{
If no match is found, proceeds to step 2.
2.
Uses static IP source guard bindings and DHCP snooping entries to match the sender IP and
MAC addresses of the ARP packet.
{
If a match is found, the device forwards the ARP packet.
{
If no match is found, the device discards the ARP packet.
Static IP source guard bindings are created by using the
ip source binding
command. For more
information, see "Configuring IP source guard."
DHCP snooping entries are automatically generated by DHCP snooping. For more information, see
Layer 3—IP Services Configuration Guide
.
Configuration guidelines
You must specify a VLAN for an IP source guard binding. Otherwise, no ARP packets can match the
IP source guard binding.
Configuration procedure
To configure user validity check:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
(Optional.) Configure a user
validity check rule.
arp detection rule
rule
-
id
{
deny
|
permit
}
ip
{
any
|
ip-address
[
ip-address-mask
] }
mac
{
any
|
mac-address
[
mac-address-mask
] } [
vlan
vlan-id
]
By default, no user validity check
rule is configured.
3.
Enter VLAN view.
vlan vlan-id
N/A
4.
Enable ARP detection.
arp detection enable
By default, ARP detection is
disabled.
5.
Return to system view.
quit
N/A
6.
Enter Layer 2 Ethernet
interface view or Layer 2
aggregate interface view.
interface interface-type
interface-number
N/A
7.
(Optional.) Configure the
interface as a trusted interface
excluded from ARP detection.
arp detection trust
By default, an interface is untrusted.
Configuring ARP packet validity check
Enable validity check for ARP packets received on untrusted ports and specify the following objects
to be checked:
